v1.9.0 — fully open source

NexusPuppet is now fully open source. Directory authentication (LDAP and Active Directory), single sign-on (OIDC), custom roles and audit forwarding move from a private repository into this one, under Apache-2.0. There is no paid tier, no licence key, and no feature held back.

No migration.

Changed

The enterprise layer ships here. packages/enterprise is part of this repository. It carried its own "Proprietary and Confidential" LICENSE and declared "license": "UNLICENSED"; both are gone, and the root Apache-2.0 licence governs the whole tree.

Licensing is removed, not disabled. LICENSE_SERVICE, ILicenseService and LicenseStatus are deleted from @nexuspuppet/contracts, and the enterprise layer no longer filters what it registers by entitlement. An unused entitlement checker is exactly the "documented field that nothing populates" that ADR-0014 was written to end.

ADR-0014 is Rejected, never ratified. What it got right is worth keeping if licensing ever returns: offline verification with no phone-home, and degradation that can never touch classification or the ENC. What it got wrong was timing — the product had no paying users, so the gate cost adoption and protected nothing.

ADR-0002 is amended, not superseded. Core still does not import the enterprise package. It depends on interfaces in @nexuspuppet/contracts, and the layer registers implementations at runtime; ESLint still forbids a direct import. That seam is now an internal boundary keeping the auth and audit integrations independently testable, rather than a commercial one.

One npm install builds everything. packages/enterprise is a real workspace member: ldapts moves from an optional peer dependency to an ordinary one, and its private lockfile is gone.

Removed

npm run enterprise:fetch, scripts/enterprise.mjs, NEXUSPUPPET_ENTERPRISE_REPO and NEXUSPUPPET_ENTERPRISE_REF. They could not survive the code being in-repo: with packages/enterprise tracked, the script's existing-checkout branch would run git -C packages/enterprise fetch, and with no nested .git that walks up and operates on the NexusPuppet repository itself.

Upgrading

Core deployments: nothing changes. EDITION=core still builds an image without packages/enterprise, and CI still proves core builds without it.

If your pipeline calls enterprise:fetch, remove that step. Node on the deployment host is no longer required for the enterprise edition.

To switch a deployment from core to enterprise — no licence, no repository access:

git fetch --tags && git checkout v1.9.0
sed -i 's/^EDITION=core/EDITION=enterprise/' .env
docker compose build api
docker compose up -d

Switching edition and configuring a directory are separate changes. Flip the edition, confirm the API boots and local login still works, then point it at a directory. Local accounts are never displaced: AuthProviderResolver dispatches on each account's authSource and the local provider is never overridden (ADR-0015 §3).

---

Verified on staging before tagging: enterprise layer loads from the in-repo package, login, node inventory, node groups, resource search, LDAP settings and the console all healthy; no errors at boot.