Ensure no commercial crates are part of the OSS builds

[dani-garcia]

🎟️ Tracking

📔 Objective

Commercial (Bitwarden-licensed) crates under bitwarden_license/ must never ship in a non-commercial build, but a non-weak feature reference silently defeated that: bitwarden-pm's wasm feature listed "bitwarden-commercial-vault/wasm", which force-activates the optional dependency whenever wasm is enabled. Since bitwarden-wasm-internal always builds bitwarden-pm with wasm, the standard non-commercial WASM artifact was compiling in commercial code unnoticed.

This PR fixes the leak and adds a compile-time guard so it can't come back:

• Fix: commercial dependencies are now referenced weakly (bitwarden-commercial-vault?/wasm) in every feature except bitwarden-license.
• Guard: a new internal crate bitwarden-commercial-marker exports a commercial_crate!() macro that expands to a compile_error! under --cfg bitwarden_ensure_non_commercial. Every bitwarden_license/ crate calls it (and the marker self-invokes), so any commercial crate in the graph poisons such a build. cargo-udeps keeps the dep and the call in sync.
• CI: all non-commercial distribution builds now set RUSTFLAGS="--cfg bitwarden_ensure_non_commercial" (WASM build.sh non--b variant, swift/build.sh), turning a leak into a hard build failure. bitwarden-uniffi has no commercial crates for the moment, so its mobile builds set the cfg unconditionally.

Adding a new commercial crate only requires the one-line marker dependency plus the commercial_crate!() call; bitwarden_license/CLAUDE.md documents this with a reviewer checklist. bitwarden-pam (re-added here) is the first case.

🚨 Breaking Changes

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This PR fixes a commercial-code leak where bitwarden-pm's wasm feature force-activated bitwarden-commercial-vault via a non-weak feature reference, and adds a compile-time guard (bitwarden-commercial-marker) plus CI RUSTFLAGS to turn any future leak into a hard build failure. I verified the weak-reference fix is complete across the workspace, that all commercial crates (vault, pam, sm) carry the marker dependency and macro call, and that the shell quoting in both build scripts concatenates the cfg correctly.

Code Review Details

No blocking findings.

Verification notes:

• The ?/wasm fix in crates/bitwarden-pm/Cargo.toml is the only consumer reference; no other non-weak commercial references exist in the workspace.
• bitwarden-commercial-marker is no_std, gates ::core::compile_error! on the cfg, self-invokes, and is only reachable through commercial crates — so it never enters a non-commercial build graph.
• WASM build.sh sets the cfg only when the license feature is off; Swift build.sh appends to a pre-existing RUSTFLAGS, so it does not override .cargo/config.toml target flags (unlike the Android case discussed in the earlier resolved thread).
• Shell concatenation '...'" ${NO_COMMERCIAL_CFG}" is correct; an empty value only appends a harmless trailing space.

[github-actions]

🔍 SDK Breaking Change Detection

SDK Version: ps/ensure-no-commercial (bd3b438)

⚠️ If breaking changes are detected, a corresponding pull request addressing them must be ready for merge in the affected client repository.

Client	Status	Details
android	❌ Breaking changes detected	Compilation failed with new SDK version. A corresponding pull request addressing the breaking changes must be ready for merge in bitwarden/android. - View Details
typescript	✅ No breaking changes detected	Compilation passed with new SDK version - View Details

---

Breaking change detection uses the build of the SDK from this branch, including any incompatibities pre-existing on or merged into this branch. Check the workflow logs to confirm.
Results update as workflows complete.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.49%. Comparing base (f428a43) to head (e2cac7b).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1248   +/-   ##
=======================================
  Coverage   85.49%   85.49%           
=======================================
  Files         482      482           
  Lines       67340    67340           
=======================================
  Hits        57573    57573           
  Misses       9767     9767           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.