feat: publish the enterprise layer under Apache-2.0

[eth-man]

What

NexusPuppet is now fully open source. Directory authentication (LDAP and Active Directory), single sign-on (OIDC) and audit forwarding move from the private repository into this one — 44 files, ~3,900 lines. No paid tier, no feature held back.

Relicensed — the thing worth reviewing first

The package carried its own LICENSE reading "Proprietary and Confidential — NOT covered by the Apache License 2.0", with "license": "UNLICENSED" and a README saying the same.

Publishing the source while it was labelled proprietary would have been worse than not publishing it: legally contradictory, and it would deter exactly the contributors this is meant to attract. That LICENSE is gone (the root Apache-2.0 governs the repository), license is now Apache-2.0, and the README and package description no longer claim otherwise.

Retired the fetch mechanism

scripts/enterprise.mjs, the enterprise:fetch script, and NEXUSPUPPET_ENTERPRISE_REPO / _REF are deleted. They could not survive the code being in-repo: with packages/enterprise tracked, the script's existsSync() branch would run git -C packages/enterprise fetch, and with no nested .git that walks up and operates on this repository.

Now a real workspace member

ldapts moves from an optional peer dependency to an ordinary one, the package's private lockfile is deleted, and the root lockfile covers it. A fresh clone builds with a single npm install — which is the point of publishing it. This also ends the split instruction where a deployment host and a dev checkout needed different install commands.

Now linted

The package sat in ESLint's global ignore list because it was foreign code. One real finding: a bare transport.configured; in settings-transport.spec.ts, where the read is the point — the getter starts a lazy refresh as a side effect. Now void transport.configured;, which says so.

CI

Assert the enterprise layer is absent would have failed outright. Replaced with Assert the runtime seam and no committed secrets, keeping the checks that still matter: no static import outside enterprise.loader.ts, no committed certificate material, no private key blocks.

ADR-0002 amended, not superseded

Core still does not import the package — it depends on interfaces in @nexuspuppet/contracts, and the layer registers implementations at runtime. That seam is now an internal boundary that keeps these integrations independently testable, rather than a commercial one. Whether it still earns its keep with nothing private behind it is deliberately left open, for Stage 3.

Pre-publication scan

Working tree and all 25 commits of the private repo's history were scanned before anything was pushed:

• no private keys, SSH keys, GitHub tokens or AWS keys
• no real IPs, internal hostnames, corp.local, DC01 or bind accounts
• no personal addresses — commits authored by the GitHub noreply address
• every email a reserved test domain (example.com, .test, nexuspuppet.test)
• all passwords obviously synthetic (alice-password, test-admin-password)

Verified

build · typecheck · lint · prettier all exit 0 · 879 api tests · 248 enterprise tests

🤖 Generated with Claude Code

https://claude.ai/code/session_01HzdMh5WSqgEA1frZYNAtPf