schema 2.0 for packages.json