بِسْمِ اللَّهِ الرَّحْمَٰنِ الرَّحِيمِ
In the name of Allah, the Compassionate, the Merciful
@modelscript/ee contains the proprietary enterprise control-plane, air-gapped compliance appliance, and commercial licensing modules for ModelScript, licensed under LicenseRef-ModelScript-Enterprise (see LICENSE).
All 90 engineering language compilers, WebAssembly GLR parsers, the DAEBuilder simulation arena, the Nelson-Oppen semantic theory coordinator, and the Community Edition server/CLI/IDE outside ee/ remain 100% open source under AGPL-3.0-or-later.
| Batch / Subsystem | Path | License Feature Gate | Description |
|---|---|---|---|
| License Core | src/license/verifier.tssrc/license/middleware.ts |
MSX_LICENSE_KEY |
Zero-network Ed25519 cryptographic license token signing, verification, and Express middleware (/api/v1/ee/license/status) |
| Batch A: Air-Gap, Regulatory Dossiers & Telecom Siting | src/compliance/airgap.tssrc/compliance/dhf-attestation.tssrc/compliance/regulatory-dossier.tssrc/compliance/telecom-compliance.ts |
airgap_compliancedhf_attestation |
Strict FERC CEII (18 CFR § 388.113) & NERC CIP CSP headers, Ed25519-signed FDA 21 CFR Part 11 / IEEE 2800 / EN 14363 compliance attestations, NERC RSAW & NIST OSCAL regulatory dossiers (msx dossier), and FCC OET-65 / BDC / NORS / FAA Part 77 telecom siting compliance |
| Batch B: Corporate SSO & Organization RBAC | src/auth/oidc.tssrc/auth/sso-governance.ts |
saml_oidc_sso |
Enterprise OpenID Connect (OIDC) & SAML 2.0 federation (OidcService), JWKS verification, JIT Active Directory group-to-role provisioning, and /api/v1/organizations RBAC |
| Batch C: Slurm HPC & Cloud Billing | src/hpc-billing/hpc-governance.ts |
slurm_hpc |
Slurm sbatch HPC offload, Cloud CAE sweeps (/api/v1/cae, /api/v1/cloud), and Stripe Compute Credit Wallet (/api/v1/billing) |
| Batch D: Digital Twins & Enterprise Gateways | src/twins/twins-governance.tssrc/interop/interop-governance.ts |
digital_twinssysml2_omg_apimcp_sse_gateway |
Operational Digital Twins (/api/v1/twins), Hardware Birth Certificates (/api/v1/instances), TimescaleDB Historian (/api/v1/historian), OMG SysML v2 REST (/api/v1/sysml2), and Hosted MCP SSE Gateway (/api/v1/mcp) |
| Batch E: Digital Thread & Export Compliance | src/thread/thread-governance.tssrc/compliance/export-control.ts |
digital_thread_governanceairgap_compliance |
Cross-domain Digital Thread Hypergraph & OSLC Conflict Registry (/api/v1/threads) and ITAR / EAR / OFAC export-control enforcement |
| Batch F: Distributed Co-Simulation Master | src/twins/twins-governance.ts |
digital_twins |
Distributed MQTT / FMI 2.0 & 3.0 Co-Simulation Master Orchestrator (/api/v1/cosim, /api/v1/mqtt/participants) |
| Batch G: Real-Time HIL & PLM Connectors | src/hil-plm/hil-plm-governance.ts |
hil_codegenplm_connectors |
Deterministic C99 / CIGRE B4 DLL / AUTOSAR / IEC 61131-3 / FMI binary codegen & OSLC / ReqIF / Simulink / ADAMS / GT-SUITE / PSS®E / PSLF / PowerFactory CLI & API gates (/api/v1/ee/capabilities, /api/v1/ee/hil/*, /api/v1/ee/plm/*) |
| Batch H: Admin Console, ISO Gatekeeper, DevSecOps & Desktop | src/admin-devops/admin-devops-governance.tssrc/admin-devops/gatekeeper-pipeline.tssrc/admin-devops/gatekeeper-service.tssrc/desktop/desktop-compliance.ts |
airgap_complianceplm_connectorshil_codegen |
Enterprise Admin Console & SIEM audit exports (/api/v1/admin/*), 5-stage Automated ISO Interconnection Gatekeeper (msx gatekeeper), signed CI/CD webhooks (/api/v1/webhooks), GitLab bridge (/api/v1/git, /api/v1/gitlab), W3C SPARQL 1.1 Knowledge Graph (/api/v1/libraries/sparql), and Air-Gapped Desktop & Black-Box Binary FMU gates |
| Batch I: Multi-User Co-Editing, AI PR Reviews & AASX/KPAR | src/collab-reviews/collab-reviews-governance.ts |
saml_oidc_ssoplm_connectorssysml2_omg_api |
Real-Time WebSocket Co-Editing & Symbol Collision Detection (/api/v1/collab/stream, /api/v1/ee/collab/status), Private Repository Visibility, Automated AI PR Reviews (/api/v1/repos/:id/reviews), and Industry 4.0 .aasx / OMG .kpar Digital Twin Archive Export |
| Offline License Minting CLI | src/cli/license-cli.ts |
Ed25519 Private Key | CLI tool (npm run ee:keygen, npm run ee:sign-license, npm run ee:verify-license) for generating Ed25519 keypairs and issuing offline msx_lic_... customer tokens |
| Appliance Deployment Manifests | deploy/ |
MSX_EDITION=ee |
Hardened Docker Compose and Kubernetes manifests for zero-internet utility, energy, and transportation deployments |
| Environment Variable | Behavior |
|---|---|
MSX_EDITION=ee (default when ee/ is present) |
Mounts all @modelscript/ee subsystems (Batches A–I) into the API server, CLI, and Desktop Studio |
MSX_EDITION=ce |
Pure AGPL-3.0 Community Edition mode; skips loading @modelscript/ee and returns HTTP 501 Not Implemented on enterprise-only endpoints |
MSX_LICENSE_ENFORCE=true |
Enforces cryptographic Ed25519 validation of MSX_LICENSE_KEY and per-feature entitlements (402 Payment Required / 403 Forbidden when unlicensed or expired) |
# 1. Generate a production Ed25519 license signing keypair (saved to gitignored .keys/) npm run ee:keygen -- --out-dir=.keys # 2. Mint an offline 1-year Enterprise Appliance license for 50 seats npm run ee:sign-license -- --private-key=.keys/msx-license-private.pem --org="ERCOT Grid Operations" --tier=appliance --seats=50 --days=365 # 3. Verify a license token offline against the embedded production public key npm run ee:verify-license -- msx_lic_...
CI (.github/workflows/ci.yml) and Release (.github/workflows/release.yml) build and publish both Community Edition (-ce) and Enterprise Edition (-ee) Docker images from the root Dockerfile:
| Image | Target | /app/ee Included? |
Default Environment | Use Case |
|---|---|---|---|---|
ghcr.io/modelscript/api-ce |
api-ce |
No (physically stripped) | MSX_EDITION=ce + integrated VS Code Web IDE host |
Self-hosted AGPL-3.0 Community Edition API & Web IDE |
ghcr.io/modelscript/cli-ce |
cli-ce |
No (physically stripped) | MSX_EDITION=ce |
Open-core AGPL-3.0 CI/CD CLI runner |
ghcr.io/modelscript/api-ee |
api-ee (api) |
Yes | MSX_EDITION=ee, MSX_LICENSE_ENFORCE=true + integrated VS Code Web IDE host |
modelscript.org Cloud & Corporate EE multi-container self-hosting |
ghcr.io/modelscript/cli-ee |
cli-ee (cli) |
Yes | MSX_EDITION=ee, MSX_LICENSE_ENFORCE=true |
Licensed Enterprise CI/CD & HIL codegen runner |
ghcr.io/modelscript/appliance |
appliance |
Yes | MSX_EDITION=ee, MSX_LICENSE_ENFORCE=true, ENTERPRISE_APPLIANCE=true, AIRGAP_ENFORCED=true |
Single-container air-gapped Enterprise Intranet Appliance (:8080) |
ghcr.io/modelscript/web |
web |
N/A | Nginx SPA (/) + VitePress Docs (/docs) + IDE Reverse Proxy (/vscode) |
Unified Web UI, IDE Shell & Documentation Portal |
# Single container (physically excludes /app/ee) docker run -d -p 3000:3000 -e JWT_SECRET="$(openssl rand -hex 32)" ghcr.io/modelscript/api-ce:latest # Or full local stack via Docker Compose MSX_EDITION=ce JWT_SECRET="$(openssl rand -hex 32)" docker compose --profile standalone up -d
# Single-container Air-Gapped Intranet Appliance (port 8080) MSX_LICENSE_KEY="msx_lic_<PAYLOAD>.<SIGNATURE>" JWT_SECRET="$(openssl rand -hex 32)" \ docker compose --profile appliance up -d # Or Kubernetes StatefulSet (with zero-egress NetworkPolicy) kubectl apply -f ee/deploy/kubernetes-appliance.yaml
cp .env.production.example .env.production
# Populate JWT_SECRET, STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET in .env.production
docker compose -f docker-compose.yml -f docker-compose.prod.yml --env-file .env.production --profile federated pull
docker compose -f docker-compose.yml -f docker-compose.prod.yml --env-file .env.production --profile federated up -d --remove-orphans