@openmbee/opensysml 0.9.1

package/dist/node/index.js

@@ -0,0 +1,101 @@
+// Node entry point: everything the core does, plus the private-child lifecycle.
+import { createConnectTransport, createGrpcTransport } from "@connectrpc/connect-node";
+import { Connection } from "../core/connection.js";
+import { OpenSysMLError } from "../core/errors.js";
+import { Model } from "../core/model.js";
+import { baseUrl, encodingOf, interceptors, timeoutOf } from "../core/transport.js";
+import { acquirePrivateService } from "./service.js";
+export * from "../core/index.js";
+export { ALLOW_UNPINNED_ENV, API_BASE_URL, BINARY_ENV, BinaryNotFoundError, DEFAULT_GITHUB_REPO, NETWORK_TIMEOUT_MS, PINNED_SHA256, RELEASES_BASE_URL, REPO_ENV, VERSION_ENV, binaryName, cachedBinaryPath, cachedRelease, defaultGithubRepo, downloadBinary, expectedDigest, metadataPath, pinnedDigest, platformPackage, releaseAssetName, releaseDownloadUrl, resolveBinary, resolveLatestVersion, signedManifestDigest, staleCacheReason, unpinnedDownloadsAllowed, verifyChecksum, writeMetadata, } from "./binary.js";
+export { BUNDLE_ASSET, MANIFEST_ASSET, ReleaseSigner, SIGNED_MANIFEST_SIGNERS, manifestDigest, signerFor, verifiedManifestDigest, verifyManifest, } from "./signing.js";
+export { PrivateService, currentPrivateService } from "./service.js";
+/** Names a service to connect to instead of starting one. */
+export const SERVICE_ENV = "OPENSYSML_SERVICE";
+/**
+ * Connects to a sysml-grpc service.
+ *
+ * With no address, this starts a private child of this process — one per thread,
+ * shared by every connection, stopped when the last one closes. With an address,
+ * or with `$OPENSYSML_SERVICE` set, it connects to a service someone else runs and
+ * closing the connection leaves that service running.
+ */
+export async function connect(options = {}) {
+    const address = options.address ?? process.env[SERVICE_ENV];
+    if (address !== undefined && address !== "") {
+        return connectExternal(address, options);
+    }
+    return connectPrivate(options);
+}
+/** Parses a file over a connection of its own, which the model closes. */
+export async function load(path, options = {}) {
+    const connection = await connect(options);
+    try {
+        return await Model.parse(connection, { source: { case: "filePath", value: path } }, options, true);
+    }
+    catch (error) {
+        await connection.close();
+        throw error;
+    }
+}
+/** Parses inline source over a connection of its own, which the model closes. */
+export async function loads(source, options = {}) {
+    const connection = await connect(options);
+    try {
+        return await Model.parse(connection, { source: { case: "content", value: source } }, options, true);
+    }
+    catch (error) {
+        await connection.close();
+        throw error;
+    }
+}
+async function connectPrivate(options) {
+    // Checked before a child is started, so a bad option costs no process.
+    const encoding = encodingOf(options);
+    const timeoutMs = timeoutOf(options);
+    const service = await acquirePrivateService();
+    const backend = {
+        origin: `${service.binary.path}, started by this client`,
+        release: () => service.release(),
+    };
+    try {
+        return await Connection.open({
+            transport: transportFor(baseUrl(service.address), options),
+            encoding,
+            backend,
+            timeoutMs,
+        });
+    }
+    catch (error) {
+        await service.release();
+        throw error;
+    }
+}
+async function connectExternal(address, options) {
+    const url = baseUrl(address);
+    const timeoutMs = timeoutOf(options);
+    return Connection.open({
+        transport: transportFor(url, options),
+        encoding: encodingOf(options),
+        backend: {
+            origin: `${url}, which this client did not start`,
+            // A service this client did not start is never stopped by it.
+            release: () => Promise.resolve(),
+        },
+        timeoutMs,
+    });
+}
+function transportFor(url, options) {
+    const binary = encodingOf(options) === "protobuf";
+    if (options.protocol === "grpc") {
+        if (!binary) {
+            throw new OpenSysMLError("the gRPC protocol carries protobuf bodies; JSON needs the Connect protocol");
+        }
+        return createGrpcTransport({ baseUrl: url, interceptors: interceptors(options) });
+    }
+    return createConnectTransport({
+        baseUrl: url,
+        httpVersion: options.httpVersion ?? "2",
+        useBinaryFormat: binary,
+        interceptors: interceptors(options),
+    });
+}

package/dist/node/service.d.ts

@@ -0,0 +1,31 @@
+import { type Binary } from "./binary.js";
+/** A sysml-grpc child of this process, shared by every connection that needs one. */
+export declare class PrivateService {
+    readonly address: string;
+    readonly binary: Binary;
+    /** Connections holding it; the last one released stops it. */
+    refs: number;
+    private readonly child;
+    private readonly stderr;
+    private ended;
+    private constructor();
+    /** The process id of the child, which the orphan-safety test reads. */
+    get pid(): number | undefined;
+    /** Whether the child is still there to be used. */
+    get alive(): boolean;
+    /** The last lines the child wrote to stderr, for an error message. */
+    get log(): readonly string[];
+    /** Drops one hold, stopping the child when it was the last. */
+    release(): Promise<void>;
+    /**
+     * Stops the child. Closing the pipe would end it on its own; it is signalled as
+     * well so a connection closed in a long-lived process does not wait on the read.
+     */
+    stop(): Promise<void>;
+    /** Starts a child and waits for the address it bound. */
+    static start(): Promise<PrivateService>;
+}
+/** Takes a hold on this thread's private child, starting one when there is none. */
+export declare function acquirePrivateService(): Promise<PrivateService>;
+/** The private child this thread holds, for tests and diagnostics. */
+export declare function currentPrivateService(): PrivateService | undefined;

package/dist/node/service.js

@@ -0,0 +1,238 @@
+// The private child: a sysml-grpc this process started and only it can reach.
+// It reports its kernel-assigned port on stdout, and exits at end of file on the
+// stdin pipe this process holds open — which SIGKILL closes and an exit hook does not.
+import { spawn } from "node:child_process";
+import { ServiceStartError } from "../core/errors.js";
+import { resolveBinary } from "./binary.js";
+const START_TIMEOUT_MS = 10_000;
+const STOP_TIMEOUT_MS = 5_000;
+const STDERR_LINES_KEPT = 20;
+/** The one private child of this thread, and the connections holding it. */
+let shared;
+/** A start in flight, so concurrent connect() calls share one child. */
+let starting;
+/** A sysml-grpc child of this process, shared by every connection that needs one. */
+export class PrivateService {
+    address;
+    binary;
+    /** Connections holding it; the last one released stops it. */
+    refs = 0;
+    child;
+    stderr;
+    ended;
+    constructor(init) {
+        this.child = init.child;
+        this.binary = init.binary;
+        this.address = init.address;
+        this.stderr = init.stderr;
+        this.ended = false;
+        this.child.once("exit", () => {
+            this.ended = true;
+        });
+    }
+    /** The process id of the child, which the orphan-safety test reads. */
+    get pid() {
+        return this.child.pid;
+    }
+    /** Whether the child is still there to be used. */
+    get alive() {
+        return !this.ended && this.child.exitCode === null && this.child.signalCode === null;
+    }
+    /** The last lines the child wrote to stderr, for an error message. */
+    get log() {
+        return this.stderr;
+    }
+    /** Drops one hold, stopping the child when it was the last. */
+    async release() {
+        this.refs -= 1;
+        if (this.refs > 0) {
+            return;
+        }
+        if (shared === this) {
+            shared = undefined;
+        }
+        await this.stop();
+    }
+    /**
+     * Stops the child. Closing the pipe would end it on its own; it is signalled as
+     * well so a connection closed in a long-lived process does not wait on the read.
+     */
+    async stop() {
+        if (!this.alive) {
+            this.child.stdin.destroy();
+            return;
+        }
+        // Waiting for the child is this program's work again, so its handle is
+        // referenced for as long as the wait lasts.
+        this.child.ref();
+        const exited = new Promise((resolve) => {
+            this.child.once("exit", () => {
+                resolve();
+            });
+        });
+        this.child.stdin.end();
+        this.child.kill("SIGTERM");
+        const killed = await withTimeout(exited, STOP_TIMEOUT_MS);
+        if (!killed) {
+            this.child.kill("SIGKILL");
+            await exited;
+        }
+        this.child.stdout.destroy();
+        this.child.stderr.destroy();
+        this.child.stdin.destroy();
+    }
+    /** Starts a child and waits for the address it bound. */
+    static async start() {
+        const binary = await resolveBinary();
+        const child = spawn(binary.path, ["-port", "0", "-health-port", "0", "-report-address", "-exit-with-parent"], {
+            stdio: ["pipe", "pipe", "pipe"],
+            // A new session (a new process group on Windows), so a Ctrl-C meant for
+            // this process does not reach the child mid-call.
+            detached: true,
+            windowsHide: true,
+        });
+        const stderr = tail(child, STDERR_LINES_KEPT);
+        const address = firstLine(child);
+        let reported;
+        try {
+            // The handles stay referenced until the address arrives: this read is the
+            // program's work, and unreferencing it first would let Node exit mid-start.
+            reported = await address;
+        }
+        catch (cause) {
+            child.stdin.end();
+            child.kill("SIGKILL");
+            throw new ServiceStartError(startFailure(binary, stderr, cause), { cause });
+        }
+        // From here the child is not this program's work: a referenced handle would
+        // stop a script that forgot close() from ever exiting.
+        child.unref();
+        unrefHandle(child.stdin);
+        unrefHandle(child.stdout);
+        unrefHandle(child.stderr);
+        return new PrivateService({
+            child,
+            binary,
+            address: reported,
+            stderr,
+        });
+    }
+}
+/** Takes a hold on this thread's private child, starting one when there is none. */
+export async function acquirePrivateService() {
+    for (;;) {
+        const existing = shared;
+        if (existing?.alive) {
+            existing.refs += 1;
+            return existing;
+        }
+        starting ??= PrivateService.start()
+            .then((service) => {
+            shared = service;
+            return service;
+        })
+            .finally(() => {
+            starting = undefined;
+        });
+        await starting;
+    }
+}
+/** The private child this thread holds, for tests and diagnostics. */
+export function currentPrivateService() {
+    return shared;
+}
+function startFailure(binary, stderr, cause) {
+    const why = cause instanceof Error ? cause.message : String(cause);
+    const log = stderr.length === 0 ? "" : `\n  it wrote: ${stderr.join("\n            ")}`;
+    return `${binary.path} did not report an address it is serving: ${why}${log}`;
+}
+/** Resolves with the child's first stdout line, then drains the rest. */
+function firstLine(child) {
+    return new Promise((resolve, reject) => {
+        let buffered = "";
+        let settled = false;
+        const timer = setTimeout(() => {
+            finish(() => {
+                reject(new Error(`no address within ${START_TIMEOUT_MS} ms`));
+            });
+        }, START_TIMEOUT_MS);
+        timer.unref();
+        const finish = (settle) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            clearTimeout(timer);
+            child.stdout.off("data", onData);
+            // The child must never block writing to a full pipe, so keep reading.
+            child.stdout.resume();
+            settle();
+        };
+        const onData = (chunk) => {
+            buffered += chunk.toString();
+            const newline = buffered.indexOf("\n");
+            if (newline === -1) {
+                return;
+            }
+            const line = buffered.slice(0, newline).trim();
+            finish(() => {
+                if (line === "") {
+                    reject(new Error("its first line of output was empty"));
+                }
+                else {
+                    resolve(line);
+                }
+            });
+        };
+        child.stdout.on("data", onData);
+        child.once("error", (error) => {
+            finish(() => {
+                reject(error);
+            });
+        });
+        child.once("exit", (code, signal) => {
+            finish(() => {
+                reject(new Error(`it exited (code ${code ?? "none"}, signal ${signal ?? "none"}) first`));
+            });
+        });
+    });
+}
+/** Stops a stdio pipe from holding the event loop open; they are sockets, which unref. */
+function unrefHandle(stream) {
+    const handle = stream;
+    handle.unref?.();
+}
+/** Keeps the last `lines` lines the child wrote to stderr. */
+function tail(child, lines) {
+    const kept = [];
+    let buffered = "";
+    child.stderr.on("data", (chunk) => {
+        buffered += chunk.toString();
+        const parts = buffered.split("\n");
+        buffered = parts.pop() ?? "";
+        for (const part of parts) {
+            kept.push(part);
+            if (kept.length > lines) {
+                kept.shift();
+            }
+        }
+    });
+    return kept;
+}
+async function withTimeout(promise, ms) {
+    let timer;
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(() => {
+            resolve(false);
+        }, ms);
+        timer.unref();
+    });
+    try {
+        return await Promise.race([promise.then(() => true), timeout]);
+    }
+    finally {
+        if (timer !== undefined) {
+            clearTimeout(timer);
+        }
+    }
+}

package/dist/node/signing.d.ts

@@ -0,0 +1,55 @@
+/** Manifest of every published artifact's digest, and its sigstore bundle. */
+export declare const MANIFEST_ASSET = "SHA256SUMS.txt";
+export declare const BUNDLE_ASSET = "SHA256SUMS.txt.bundle";
+/** The sigstore packages this module verifies with, imported on demand. */
+interface Sigstore {
+    bundle: typeof import("@sigstore/bundle");
+    specs: typeof import("@sigstore/protobuf-specs");
+    tuf: typeof import("@sigstore/tuf");
+    verify: typeof import("@sigstore/verify");
+}
+/** The identity a release manifest's signature must carry. */
+export declare class ReleaseSigner {
+    /** OIDC issuer the certificate must have been issued for. */
+    readonly issuer: string;
+    /** CircleCI project API URL the certificate subject must belong to. */
+    readonly project: string;
+    /** Pipeline definition the subject must name exactly, or any of the project. */
+    readonly definition: string | undefined;
+    /** Sigstore trusted root to verify against, or Sigstore's production instance. */
+    readonly trustedRootPath: string | undefined;
+    constructor(init: {
+        issuer: string;
+        project: string;
+        definition?: string;
+        trustedRootPath?: string;
+    });
+    /** Certificate subject required, or undefined when any definition is accepted. */
+    get subject(): string | undefined;
+    /** The identity, for an error message. */
+    describe(): string;
+    /**
+     * The verification policy for this identity. The subject pattern is anchored,
+     * since sigstore matches it as an unanchored regular expression.
+     */
+    policy(): import("@sigstore/verify").VerificationPolicy;
+    /** A verifier holding the root of trust this signer's certificates chain to. */
+    verifier(sigstore: Sigstore): Promise<import("@sigstore/verify").Verifier>;
+}
+/**
+ * Identity each repository's release manifest must be signed with: the CircleCI OIDC
+ * issuer of its organization and its project. A repository absent here signs nothing.
+ */
+export declare const SIGNED_MANIFEST_SIGNERS: Readonly<Record<string, ReleaseSigner>>;
+/** The signer whose signature a repository's release manifest must carry. */
+export declare function signerFor(githubRepo: string): ReleaseSigner | undefined;
+/** The digest a checksum manifest lists for an asset, as sha256sum writes them. */
+export declare function manifestDigest(manifest: Buffer, asset: string): string | undefined;
+/**
+ * Verify a manifest's sigstore bundle against the signer expected: nothing checked at
+ * all is an UnsignedReleaseError, a signature that fails a ManifestSignatureError.
+ */
+export declare function verifyManifest(manifest: Buffer, bundle: Buffer, signer: ReleaseSigner): Promise<void>;
+/** The digest a signed manifest lists for an asset, once its signature verified. */
+export declare function verifiedManifestDigest(manifest: Buffer, bundle: Buffer, asset: string, signer: ReleaseSigner): Promise<string>;
+export {};

package/dist/node/signing.js

@@ -0,0 +1,167 @@
+// Verification of the signed checksum manifest a release publishes. A core release
+// signs its SHA256SUMS.txt in CI with cosign keyless, using the release pipeline's
+// CircleCI OIDC identity, and publishes the sigstore bundle beside it. A bundle
+// that verifies against the identity pinned here says the manifest came from that
+// pipeline, so a release published after this client can still be installed. A
+// manifest that does not verify is refused exactly as an unpinned release is.
+import { readFile } from "node:fs/promises";
+import { ManifestSignatureError, UnsignedReleaseError } from "../core/errors.js";
+/** Manifest of every published artifact's digest, and its sigstore bundle. */
+export const MANIFEST_ASSET = "SHA256SUMS.txt";
+export const BUNDLE_ASSET = `${MANIFEST_ASSET}.bundle`;
+/** How long the root of trust may take to load, matching the download timeout. */
+const TRUST_ROOT_TIMEOUT_MS = 15_000;
+// A CircleCI signing certificate's subject names the pipeline definition that
+// produced it, under the project it belongs to.
+const PIPELINE_DEFINITIONS = "/pipeline-definitions/";
+const DEFINITION_ID = "[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}";
+const SHA256 = /^[0-9a-f]{64}$/;
+/** The identity a release manifest's signature must carry. */
+export class ReleaseSigner {
+    /** OIDC issuer the certificate must have been issued for. */
+    issuer;
+    /** CircleCI project API URL the certificate subject must belong to. */
+    project;
+    /** Pipeline definition the subject must name exactly, or any of the project. */
+    definition;
+    /** Sigstore trusted root to verify against, or Sigstore's production instance. */
+    trustedRootPath;
+    constructor(init) {
+        this.issuer = init.issuer;
+        this.project = init.project;
+        this.definition = init.definition;
+        this.trustedRootPath = init.trustedRootPath;
+    }
+    /** Certificate subject required, or undefined when any definition is accepted. */
+    get subject() {
+        if (this.definition === undefined) {
+            return undefined;
+        }
+        return this.project + PIPELINE_DEFINITIONS + this.definition;
+    }
+    /** The identity, for an error message. */
+    describe() {
+        const subject = this.subject ?? `${this.project}${PIPELINE_DEFINITIONS}*`;
+        return `issuer ${this.issuer}, subject ${subject}`;
+    }
+    /**
+     * The verification policy for this identity. The subject pattern is anchored,
+     * since sigstore matches it as an unanchored regular expression.
+     */
+    policy() {
+        const subject = this.subject;
+        const pattern = subject === undefined
+            ? // No definition is pinned, so any definition of the project is accepted:
+                // no unauthenticated API publishes the identifier to pin.
+                escapeForRegExp(this.project + PIPELINE_DEFINITIONS) + DEFINITION_ID
+            : escapeForRegExp(subject);
+        return {
+            extensions: { issuer: this.issuer },
+            subjectAlternativeName: `^${pattern}$`,
+        };
+    }
+    /** A verifier holding the root of trust this signer's certificates chain to. */
+    async verifier(sigstore) {
+        const root = this.trustedRootPath === undefined
+            ? await sigstore.tuf.getTrustedRoot({ timeout: TRUST_ROOT_TIMEOUT_MS })
+            : sigstore.specs.TrustedRoot.fromJSON(JSON.parse(await readFile(this.trustedRootPath, "utf8")));
+        return new sigstore.verify.Verifier(sigstore.verify.toTrustMaterial(root));
+    }
+}
+/**
+ * Identity each repository's release manifest must be signed with: the CircleCI OIDC
+ * issuer of its organization and its project. A repository absent here signs nothing.
+ */
+export const SIGNED_MANIFEST_SIGNERS = {
+    "Open-MBEE/OpenSysML": new ReleaseSigner({
+        issuer: "https://oidc.circleci.com/org/1169df8b-0b59-400f-82d2-c9d8e98bdb62",
+        project: "https://circleci.com/api/v2/projects/eeb0dddd-237f-4f02-9e51-8e24caef589d",
+    }),
+};
+/** The signer whose signature a repository's release manifest must carry. */
+export function signerFor(githubRepo) {
+    return Object.hasOwn(SIGNED_MANIFEST_SIGNERS, githubRepo) ? SIGNED_MANIFEST_SIGNERS[githubRepo] : undefined;
+}
+/** The digest a checksum manifest lists for an asset, as sha256sum writes them. */
+export function manifestDigest(manifest, asset) {
+    for (const line of manifest.toString("utf8").split("\n")) {
+        const fields = line.split(/\s+/).filter((field) => field !== "");
+        if (fields.length !== 2) {
+            continue;
+        }
+        const [digest, name] = fields;
+        // sha256sum marks a file it read in binary mode with a leading '*'.
+        if (name.replace(/^\*+/, "") !== asset) {
+            continue;
+        }
+        const lowered = digest.toLowerCase();
+        return SHA256.test(lowered) ? lowered : undefined;
+    }
+    return undefined;
+}
+/**
+ * Verify a manifest's sigstore bundle against the signer expected: nothing checked at
+ * all is an UnsignedReleaseError, a signature that fails a ManifestSignatureError.
+ */
+export async function verifyManifest(manifest, bundle, signer) {
+    const sigstore = await loadSigstore();
+    let read;
+    try {
+        read = sigstore.bundle.bundleFromJSON(JSON.parse(bundle.toString("utf8")));
+    }
+    catch (cause) {
+        // A truncated download looks like this too, so it is an absent signature
+        // rather than evidence of a tampered one.
+        throw new UnsignedReleaseError(`the sigstore bundle published for ${MANIFEST_ASSET} could not be read ` +
+            `(${describe(cause)}), so the manifest was not verified.`, { cause });
+    }
+    let verifier;
+    try {
+        verifier = await signer.verifier(sigstore);
+    }
+    catch (cause) {
+        throw new UnsignedReleaseError(`this client could not load the sigstore root of trust needed to verify ` +
+            `${MANIFEST_ASSET} (${describe(cause)}), so the manifest was not verified.`, { cause });
+    }
+    try {
+        verifier.verify(sigstore.verify.toSignedEntity(read, manifest), signer.policy());
+    }
+    catch (cause) {
+        throw new ManifestSignatureError(`the signature on ${MANIFEST_ASSET} does not verify against the release ` +
+            `pipeline of this repository (${signer.describe()}): ${describe(cause)}. The ` +
+            `manifest, the signature, or both were replaced; nothing was installed.`, { cause });
+    }
+}
+/** The digest a signed manifest lists for an asset, once its signature verified. */
+export async function verifiedManifestDigest(manifest, bundle, asset, signer) {
+    await verifyManifest(manifest, bundle, signer);
+    const digest = manifestDigest(manifest, asset);
+    if (digest === undefined) {
+        throw new UnsignedReleaseError(`the signed ${MANIFEST_ASSET} of this release lists no SHA-256 digest for ` +
+            `${asset}, so that asset is not covered by the signature.`);
+    }
+    return digest;
+}
+/** The verifier packages, or a refusal explaining that they are not installed. */
+async function loadSigstore() {
+    try {
+        const [bundle, specs, tuf, verify] = await Promise.all([
+            import("@sigstore/bundle"),
+            import("@sigstore/protobuf-specs"),
+            import("@sigstore/tuf"),
+            import("@sigstore/verify"),
+        ]);
+        return { bundle, specs, tuf, verify };
+    }
+    catch (cause) {
+        throw new UnsignedReleaseError(`this client cannot verify the signature on ${MANIFEST_ASSET}: ` +
+            `${describe(cause)}. Install its optional sigstore dependencies, or ask for ` +
+            `a release it pins a digest for with version.`, { cause });
+    }
+}
+function describe(cause) {
+    return cause instanceof Error ? `${cause.name}: ${cause.message}` : String(cause);
+}
+function escapeForRegExp(literal) {
+    return literal.replace(/[.*+?^${}()|[\]\\/]/g, String.raw `\$&`);
+}

package/package.json

@@ -0,0 +1,77 @@
+{
+  "name": "@openmbee/opensysml",
+  "version": "0.9.1",
+  "description": "OpenSysML client: parse, evaluate and instantiate SysML v2 models over the sysml-grpc Connect API",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Open-MBEE/OpenSysML.git",
+    "directory": "client/node"
+  },
+  "homepage": "https://github.com/Open-MBEE/OpenSysML/tree/main/client/node#readme",
+  "keywords": [
+    "sysml",
+    "sysml-v2",
+    "mbse",
+    "connect",
+    "opensysml"
+  ],
+  "type": "module",
+  "engines": {
+    "node": ">=20.11"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/node/index.d.ts",
+      "browser": "./dist/browser/index.js",
+      "default": "./dist/node/index.js"
+    },
+    "./browser": {
+      "types": "./dist/browser/index.d.ts",
+      "default": "./dist/browser/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "release-digests.json"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "build:tools": "tsc -p tsconfig.json",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "lint": "eslint .",
+    "test": "npm run build:tools && node --test \"build/test/**/*.test.js\"",
+    "test:coverage": "npm run build:tools && c8 --reporter=text --reporter=lcovonly node --test \"build/test/**/*.test.js\"",
+    "example": "npm run build:tools && node scripts/run-example.mjs",
+    "examples": "npm run build:tools && node scripts/run-example.mjs --all",
+    "conformance": "npm run build:tools && node build/conformance/main.js --dir ../../conformance --repo ../..",
+    "platform-packages": "node scripts/build-platform-packages.mjs"
+  },
+  "dependencies": {
+    "@bufbuild/protobuf": "2.14.0",
+    "@connectrpc/connect": "2.1.2",
+    "@connectrpc/connect-node": "2.1.2",
+    "@connectrpc/connect-web": "2.1.2"
+  },
+  "optionalDependencies": {
+    "@openmbee/opensysml-sysml-grpc-darwin-arm64": "0.9.1",
+    "@openmbee/opensysml-sysml-grpc-darwin-x64": "0.9.1",
+    "@openmbee/opensysml-sysml-grpc-linux-arm64": "0.9.1",
+    "@openmbee/opensysml-sysml-grpc-linux-x64": "0.9.1",
+    "@openmbee/opensysml-sysml-grpc-win32-x64": "0.9.1",
+    "@sigstore/bundle": "4.0.0",
+    "@sigstore/protobuf-specs": "0.5.1",
+    "@sigstore/tuf": "4.0.2",
+    "@sigstore/verify": "3.1.1"
+  },
+  "devDependencies": {
+    "@bufbuild/protoc-gen-es": "2.14.0",
+    "@types/make-fetch-happen": "^10.0.4",
+    "@types/node": "22.10.5",
+    "c8": "11.0.0",
+    "eslint": "9.39.5",
+    "typescript": "5.7.3",
+    "typescript-eslint": "8.67.0"
+  }
+}