@eudiplo/cli 9.1.0-main.8be8b4e → 9.1.0-main.8e6a2ad

package/dist/index.js

@@ -22105,6 +22105,58 @@ function findUnsupportedClaimPatterns(fields, path2 = "") {
   return problems;
 }
 
+// ../../packages/eudiplo-config-format/dist/display-entries.js
+var NUMBER = String.raw`[+-]?(?:\d+(?:\.\d+)?|\.\d+)`;
+var INTEGER = String.raw`[+-]?\d+`;
+var PERCENTAGE = `${NUMBER}%`;
+function colorFunction(name, args) {
+  return String.raw`${name}\( *${args.join(" *, *")} *\)`;
+}
+var DISPLAY_COLOR_PATTERN = `^(?:${[
+  "#(?:[0-9a-fA-F]{3}){1,2}",
+  colorFunction("rgb", [INTEGER, INTEGER, INTEGER]),
+  colorFunction("rgb", [PERCENTAGE, PERCENTAGE, PERCENTAGE]),
+  colorFunction("rgba", [INTEGER, INTEGER, INTEGER, NUMBER]),
+  colorFunction("rgba", [PERCENTAGE, PERCENTAGE, PERCENTAGE, NUMBER]),
+  colorFunction("hsl", [NUMBER, PERCENTAGE, PERCENTAGE]),
+  colorFunction("hsla", [NUMBER, PERCENTAGE, PERCENTAGE, NUMBER]),
+  "transparent"
+].join("|")})$`;
+var DISPLAY_COLOR = new RegExp(DISPLAY_COLOR_PATTERN);
+var DISPLAY_COLOR_MESSAGE = "Use a CSS Color Level 3 numerical value: #rgb, #rrggbb, transparent, or lowercase rgb(), rgba(), hsl() or hsla() with comma-separated values, for example rgb(18, 16, 124).";
+function isDisplayColor(value) {
+  return DISPLAY_COLOR.test(value);
+}
+var DISPLAY_COLOR_KEYS = ["background_color", "text_color"];
+function readableDisplayColor(value) {
+  if (typeof value !== "string")
+    return void 0;
+  const color = value.trim();
+  if (isDisplayColor(color))
+    return color;
+  const lowercase = color.toLowerCase();
+  return isDisplayColor(lowercase) ? lowercase : void 0;
+}
+function findDuplicateDisplayLocales(display) {
+  const first = /* @__PURE__ */ new Map();
+  const duplicates = [];
+  display.forEach((entry, index) => {
+    const locale = typeof entry === "object" && entry !== null ? entry.locale : void 0;
+    if (typeof locale !== "string" || locale === "")
+      return;
+    const key = locale.toLowerCase();
+    const firstIndex = first.get(key);
+    if (firstIndex === void 0)
+      first.set(key, index);
+    else
+      duplicates.push({ index, firstIndex, locale });
+  });
+  return duplicates;
+}
+function duplicateDisplayLocaleMessage(duplicate) {
+  return `Locale ${duplicate.locale} is already used by display entry ${duplicate.firstIndex + 1}. OID4VCI allows one display entry per language.`;
+}
+
 // ../../packages/eudiplo-config-format/dist/config-format.js
 var CONFIG_FORMATS = {
   Tenant: { slug: "tenant", file: "TenantConfigFile", version: 4 },
@@ -22129,7 +22181,7 @@ var CONFIG_FORMATS = {
   CredentialConfig: {
     slug: "credential-config",
     file: "CredentialConfigFile",
-    version: 3
+    version: 4
   },
   PresentationConfig: {
     slug: "presentation-config",
@@ -22367,6 +22419,60 @@ var credentialConfigV2ToV3 = {
     };
   }
 };
+var credentialConfigV3ToV4 = {
+  id: "credential-config-v4-display-colors-locales",
+  kind: "CredentialConfig",
+  from: 3,
+  to: 4,
+  migrate(spec) {
+    const config = spec.config;
+    if (typeof config !== "object" || config === null || !Array.isArray(config.display))
+      return { spec };
+    const issues = [];
+    let changed = false;
+    const display = config.display.map((entry, index) => {
+      if (typeof entry !== "object" || entry === null)
+        return entry;
+      const next = { ...entry };
+      for (const key of DISPLAY_COLOR_KEYS) {
+        const value = next[key];
+        if (value === void 0)
+          continue;
+        const color = readableDisplayColor(value);
+        if (color === value)
+          continue;
+        changed = true;
+        if (color !== void 0) {
+          next[key] = color;
+          continue;
+        }
+        delete next[key];
+        if (typeof value === "string" && value.trim() === "")
+          continue;
+        issues.push({
+          severity: "warning",
+          code: "DISPLAY_COLOR_REMOVED",
+          path: `/spec/config/display/${index}/${key}`,
+          message: `Removed ${JSON.stringify(value)}, so wallets use their own color. ${DISPLAY_COLOR_MESSAGE}`
+        });
+      }
+      return next;
+    });
+    for (const duplicate of findDuplicateDisplayLocales(display))
+      issues.push({
+        severity: "required-input",
+        code: "DISPLAY_LOCALE_DUPLICATE",
+        path: `/spec/config/display/${duplicate.index}/locale`,
+        message: duplicateDisplayLocaleMessage(duplicate)
+      });
+    if (!changed && issues.length === 0)
+      return { spec };
+    return {
+      spec: changed ? { ...spec, config: { ...config, display } } : spec,
+      issues
+    };
+  }
+};
 var CONFIG_MIGRATIONS = [
   {
     id: "issuance-config-v2-offer-lifetime",
@@ -22505,6 +22611,7 @@ var CONFIG_MIGRATIONS = [
     migrate: (spec) => ({ spec })
   },
   credentialConfigV2ToV3,
+  credentialConfigV3ToV4,
   presentationConfigV1ToV2,
   {
     id: "presentation-config-v3-typed-claim-values",
@@ -34969,13 +35076,13 @@ var CONFIG_SCHEMAS = [
   },
   {
     "$schema": "https://json-schema.org/draft/2020-12/schema",
-    "$id": "https://eudiplo.dev/schemas/v4/IssuanceConfigFile.schema.json",
-    "title": "IssuanceConfigFile",
+    "$id": "https://eudiplo.dev/schemas/v4/CredentialConfigFile.schema.json",
+    "title": "CredentialConfigFile",
     "type": "object",
     "properties": {
       "$schema": {
         "type": "string",
-        "const": "https://eudiplo.dev/schemas/v4/IssuanceConfigFile.schema.json"
+        "const": "https://eudiplo.dev/schemas/v4/CredentialConfigFile.schema.json"
       },
       "metadata": {
         "type": "object",
@@ -34997,7 +35104,23 @@ var CONFIG_SCHEMAS = [
         "additionalProperties": false
       },
       "spec": {
-        "$ref": "#/$defs/IssuanceConfig"
+        "allOf": [
+          {
+            "$ref": "#/$defs/CredentialConfigCreate"
+          },
+          {
+            "type": "object",
+            "required": [
+              "id"
+            ],
+            "properties": {
+              "id": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        ]
       }
     },
     "required": [
@@ -35006,192 +35129,1204 @@ var CONFIG_SCHEMAS = [
     ],
     "additionalProperties": false,
     "$defs": {
-      "IssuanceConfig": {
+      "CredentialConfigCreate": {
         "type": "object",
         "properties": {
-          "batchSize": {
-            "description": "Optional issuance batch size.",
-            "type": "integer",
-            "minimum": 1,
-            "maximum": 9007199254740991
-          },
-          "dPopRequired": {
-            "description": "Require DPoP proofs for issuance endpoints.",
-            "type": "boolean"
-          },
-          "walletAttestationRequired": {
-            "description": "Default wallet attestation requirement for managed authorization servers.",
-            "type": "boolean"
+          "id": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Credential configuration identifier."
           },
-          "walletProviderTrustLists": {
-            "description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
-            "type": "array",
-            "items": {
-              "type": "object",
-              "properties": {
-                "trustListId": {
-                  "type": "string",
-                  "minLength": 1
-                },
-                "url": {
-                  "description": "URL of the wallet provider trust list.",
-                  "type": "string",
-                  "format": "uri"
-                },
-                "verifierKey": {
-                  "description": "Optional verifier key material used for trust list verification.",
-                  "type": "object",
-                  "propertyNames": {
-                    "type": "string"
-                  },
-                  "additionalProperties": {}
-                },
-                "verifierKeyPem": {
-                  "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
-                  "type": "string",
-                  "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
-                },
-                "verifierX509Der": {
-                  "description": "Optional verifier certificate in DER/base64 form.",
-                  "type": "string"
-                }
-              },
-              "additionalProperties": false
-            }
+          "description": {
+            "description": "Optional description for operators and tooling.",
+            "type": [
+              "string",
+              "null"
+            ]
           },
-          "walletAttestationStatusCheckMode": {
-            "description": "Default status check mode for wallet attestations at managed authorization servers: strict, best_effort (default) or disabled.",
-            "anyOf": [
-              {
+          "config": {
+            "type": "object",
+            "properties": {
+              "format": {
                 "type": "string",
                 "enum": [
-                  "strict",
-                  "best_effort",
-                  "disabled"
-                ]
+                  "mso_mdoc",
+                  "dc+sd-jwt"
+                ],
+                "description": "Credential format emitted by this configuration."
               },
-              {
-                "type": "null"
-              }
-            ]
-          },
-          "signingKeyId": {
-            "description": "Default signing key chain id for credential issuance.",
-            "type": "string",
-            "minLength": 1
-          },
-          "authorizationServers": {
-            "minItems": 1,
-            "type": "array",
-            "items": {
-              "oneOf": [
-                {
+              "display": {
+                "type": "array",
+                "items": {
                   "type": "object",
                   "properties": {
-                    "type": {
+                    "locale": {
                       "type": "string",
-                      "const": "external",
-                      "description": "Use an externally managed authorization server."
+                      "minLength": 1,
+                      "description": "Language tag of this entry, for example en-US. Each locale may appear once."
                     },
-                    "id": {
+                    "name": {
                       "type": "string",
                       "minLength": 1,
-                      "description": "Authorization server identifier."
+                      "description": "Credential name shown by wallets."
                     },
-                    "issuer": {
+                    "description": {
+                      "description": "Optional description of the credential for this locale.",
+                      "type": "string"
+                    },
+                    "background_color": {
+                      "description": "Optional background color for card-style rendering, as a CSS Color Level 3 numerical value: #rgb, #rrggbb, transparent, or lowercase rgb(), rgba(), hsl() or hsla() with comma-separated values. Without it, wallets use their own.",
                       "type": "string",
-                      "format": "uri",
-                      "description": "Issuer URL for the external authorization server."
+                      "pattern": "^(?:#(?:[0-9a-fA-F]{3}){1,2}|rgb\\( *[+-]?\\d+ *, *[+-]?\\d+ *, *[+-]?\\d+ *\\)|rgb\\( *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *\\)|rgba\\( *[+-]?\\d+ *, *[+-]?\\d+ *, *[+-]?\\d+ *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *\\)|rgba\\( *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *\\)|hsl\\( *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *\\)|hsla\\( *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *\\)|transparent)$"
                     },
-                    "sessionBinding": {
-                      "description": "Explicit mapping from an external access-token claim to an existing issuance session.",
+                    "text_color": {
+                      "description": "Optional text color for card-style rendering, as a CSS Color Level 3 numerical value: #rgb, #rrggbb, transparent, or lowercase rgb(), rgba(), hsl() or hsla() with comma-separated values. Without it, wallets use their own.",
+                      "type": "string",
+                      "pattern": "^(?:#(?:[0-9a-fA-F]{3}){1,2}|rgb\\( *[+-]?\\d+ *, *[+-]?\\d+ *, *[+-]?\\d+ *\\)|rgb\\( *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *\\)|rgba\\( *[+-]?\\d+ *, *[+-]?\\d+ *, *[+-]?\\d+ *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *\\)|rgba\\( *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *\\)|hsl\\( *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *\\)|hsla\\( *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+)% *, *[+-]?(?:\\d+(?:\\.\\d+)?|\\.\\d+) *\\)|transparent)$"
+                    },
+                    "background_image": {
+                      "description": "Optional background image.",
                       "type": "object",
                       "properties": {
-                        "method": {
-                          "type": "string",
-                          "const": "access_token_claim",
-                          "description": "Read the correlation value from a configured access-token claim."
-                        },
-                        "claim": {
+                        "uri": {
                           "type": "string",
                           "minLength": 1,
-                          "description": "Claim name that contains the issuance-session correlation value."
+                          "description": "Image URI."
                         }
                       },
                       "required": [
-                        "method",
-                        "claim"
+                        "uri"
                       ],
                       "additionalProperties": false
                     },
-                    "label": {
-                      "description": "Optional display label for UI selection.",
-                      "type": "string"
-                    },
-                    "enabled": {
-                      "description": "Whether this authorization server entry is enabled.",
-                      "type": "boolean"
-                    }
-                  },
-                  "required": [
-                    "type",
-                    "id",
-                    "issuer"
-                  ],
-                  "additionalProperties": false
-                },
-                {
-                  "type": "object",
-                  "properties": {
-                    "type": {
-                      "type": "string",
-                      "const": "oid4vp",
-                      "description": "Use OID4VP-based authorization server chaining."
-                    },
-                    "id": {
-                      "type": "string",
-                      "minLength": 1,
-                      "description": "Authorization server identifier."
-                    },
-                    "presentationConfigId": {
-                      "type": "string",
-                      "minLength": 1,
-                      "description": "Presentation configuration id used during authorization."
-                    },
-                    "immediateWalletRedirect": {
-                      "description": "Redirect wallets immediately after authorization response creation.",
-                      "type": "boolean"
-                    },
-                    "token": {
-                      "description": "Optional token issuance settings.",
+                    "logo": {
+                      "description": "Optional logo image.",
                       "type": "object",
                       "properties": {
-                        "lifetimeSeconds": {
-                          "description": "Access token lifetime in seconds.",
-                          "type": "number",
-                          "minimum": 60
-                        },
-                        "signingKeyId": {
-                          "description": "Optional key chain id used to sign issued tokens.",
+                        "uri": {
                           "type": "string",
-                          "minLength": 1
-                        },
-                        "refreshTokenEnabled": {
-                          "description": "Enable issuing refresh tokens.",
-                          "type": "boolean"
-                        },
-                        "refreshTokenExpiresInSeconds": {
-                          "description": "Refresh token lifetime in seconds.",
-                          "type": "number",
-                          "minimum": 60
+                          "minLength": 1,
+                          "description": "Image URI."
                         }
                       },
+                      "required": [
+                        "uri"
+                      ],
                       "additionalProperties": false
-                    },
-                    "requireDPoP": {
-                      "description": "Require DPoP proofs for token/credential requests.",
-                      "type": "boolean"
-                    },
+                    }
+                  },
+                  "required": [
+                    "locale",
+                    "name"
+                  ],
+                  "additionalProperties": false
+                },
+                "description": "Display metadata shown by wallets, one entry per locale."
+              },
+              "scope": {
+                "description": "Optional OAuth scope associated with this credential type.",
+                "type": "string"
+              },
+              "docType": {
+                "description": "Optional mDoc document type.",
+                "type": "string"
+              },
+              "keyAttestationsRequired": {
+                "description": "Optional key attestation requirements.",
+                "type": "object",
+                "properties": {
+                  "key_storage": {
+                    "description": "Required key storage attestations.",
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "user_authentication": {
+                    "description": "Required user authentication attestations.",
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  }
+                },
+                "additionalProperties": false
+              },
+              "proofTypesSupported": {
+                "description": "Supported proof types for issuance requests.",
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "enum": [
+                    "jwt",
+                    "attestation"
+                  ]
+                }
+              },
+              "credentialReusePolicy": {
+                "description": "Optional PID/EAA reuse policy published in credential metadata.",
+                "type": "object",
+                "properties": {
+                  "id": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "options": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "details": {
+                          "minItems": 1,
+                          "type": "array",
+                          "items": {
+                            "type": "string",
+                            "enum": [
+                              "once_only",
+                              "limited_time",
+                              "limited-time",
+                              "rotating-batch",
+                              "per-relying-party"
+                            ]
+                          }
+                        },
+                        "batch_size": {
+                          "type": "integer",
+                          "minimum": 2,
+                          "maximum": 9007199254740991
+                        },
+                        "reissue_trigger_unused": {
+                          "type": "integer",
+                          "minimum": 0,
+                          "maximum": 9007199254740991
+                        },
+                        "reissue_trigger_lifetime_left": {
+                          "type": "integer",
+                          "minimum": 0,
+                          "maximum": 9007199254740991
+                        }
+                      },
+                      "required": [
+                        "details"
+                      ],
+                      "additionalProperties": false
+                    }
+                  }
+                },
+                "required": [
+                  "id"
+                ],
+                "additionalProperties": false
+              }
+            },
+            "required": [
+              "format",
+              "display"
+            ],
+            "additionalProperties": false,
+            "description": "Issuer metadata-facing credential configuration."
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "$ref": "#/$defs/CredentialConfigCreate/$defs/__schema0"
+            },
+            "description": "Claim field definitions for credential issuance."
+          },
+          "attributeProviderId": {
+            "description": "Optional attribute provider id used to resolve claim values.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "webhookEndpointId": {
+            "description": "Not used for notifications: they go to the webhook endpoint of the offer.",
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "vct": {
+            "description": "Optional VCT value or structured VCT metadata.",
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "vct": {
+                    "description": "VCT identifier.",
+                    "type": "string"
+                  },
+                  "name": {
+                    "description": "Human-readable VCT name.",
+                    "type": "string"
+                  },
+                  "description": {
+                    "description": "Optional VCT description.",
+                    "type": "string"
+                  },
+                  "extends": {
+                    "description": "Optional base VCT reference.",
+                    "type": "string"
+                  },
+                  "extends#integrity": {
+                    "description": "Integrity hash for the extends reference.",
+                    "type": "string"
+                  },
+                  "schema_uri": {
+                    "description": "Optional schema URI for the VCT.",
+                    "type": "string"
+                  },
+                  "schema_uri#integrity": {
+                    "description": "Integrity hash for schema_uri.",
+                    "type": "string"
+                  }
+                },
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "keyBinding": {
+            "description": "Enable key binding requirements.",
+            "type": "boolean"
+          },
+          "keyChainId": {
+            "description": "Optional key chain id used for credential signing.",
+            "type": "string",
+            "minLength": 1
+          },
+          "statusManagement": {
+            "description": "Enable status management for issued credentials.",
+            "type": "boolean"
+          },
+          "activeCredentials": {
+            "description": "Optional issuer-side policy limiting simultaneously active credentials per subject. Requires statusManagement.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "enabled": {
+                    "type": "boolean",
+                    "description": "Ensure a subject has at most one active credential of this configuration."
+                  },
+                  "tracking": {
+                    "description": "How the subject's active credential set is tracked. Only 'internal' (pseudonymous, issuer-side) is currently supported.",
+                    "type": "string",
+                    "enum": [
+                      "internal"
+                    ]
+                  }
+                },
+                "required": [
+                  "enabled"
+                ],
+                "additionalProperties": false,
+                "description": "Issuer-side policy limiting the number of simultaneously active credentials per subject."
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "iaeActions": {
+            "description": "Interactive authorization steps (a presentation or a web flow) that the wallet completes, in order, before the credential is issued.",
+            "anyOf": [
+              {
+                "type": "array",
+                "items": {
+                  "oneOf": [
+                    {
+                      "type": "object",
+                      "properties": {
+                        "type": {
+                          "type": "string",
+                          "const": "openid4vp_presentation",
+                          "description": "Trigger an OpenID4VP presentation action."
+                        },
+                        "label": {
+                          "description": "Optional UI label for the action.",
+                          "type": "string"
+                        },
+                        "presentationConfigId": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Presentation configuration id to execute."
+                        }
+                      },
+                      "required": [
+                        "type",
+                        "presentationConfigId"
+                      ],
+                      "additionalProperties": false
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "type": {
+                          "type": "string",
+                          "const": "redirect_to_web",
+                          "description": "Trigger a redirect-to-web action."
+                        },
+                        "label": {
+                          "description": "Optional UI label for the action.",
+                          "type": "string"
+                        },
+                        "url": {
+                          "type": "string",
+                          "format": "uri",
+                          "description": "Destination URL for the redirect action."
+                        },
+                        "callbackUrl": {
+                          "description": "Optional callback URL after redirect completion.",
+                          "type": "string",
+                          "format": "uri"
+                        },
+                        "description": {
+                          "description": "Optional action description.",
+                          "type": "string"
+                        }
+                      },
+                      "required": [
+                        "type",
+                        "url"
+                      ],
+                      "additionalProperties": false
+                    }
+                  ],
+                  "description": "In-app experience action definitions."
+                }
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "sdJwtTrustFormat": {
+            "description": "Trust format used for SD-JWT verification metadata.",
+            "anyOf": [
+              {
+                "type": "string",
+                "enum": [
+                  "x5c",
+                  "federation"
+                ]
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "lifeTime": {
+            "description": "Credential lifetime in seconds.",
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "schemaMeta": {
+            "description": "Optional schema metadata and trust bindings.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "id": {
+                    "description": "Optional schema metadata identifier.",
+                    "type": "string"
+                  },
+                  "name": {
+                    "description": "Optional schema metadata name.",
+                    "type": "string"
+                  },
+                  "version": {
+                    "type": "string",
+                    "description": "Schema metadata version."
+                  },
+                  "rulebookURI": {
+                    "description": "Optional rulebook URI reference.",
+                    "type": "string"
+                  },
+                  "attestationLoS": {
+                    "type": "string",
+                    "enum": [
+                      "iso_18045_high",
+                      "iso_18045_moderate",
+                      "iso_18045_enhanced-basic",
+                      "iso_18045_basic"
+                    ],
+                    "description": "Assurance level for attestation requirements."
+                  },
+                  "bindingType": {
+                    "type": "string",
+                    "enum": [
+                      "claim",
+                      "key",
+                      "biometric",
+                      "none"
+                    ],
+                    "description": "Subject binding type."
+                  },
+                  "schemaURIs": {
+                    "description": "Optional schema URI entries.",
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "credentialConfigId": {
+                          "description": "Optional credential configuration id this schema URI applies to.",
+                          "type": "string"
+                        },
+                        "format": {
+                          "description": "Optional credential format for this schema URI.",
+                          "type": "string"
+                        },
+                        "uri": {
+                          "description": "Schema URI reference.",
+                          "type": "string"
+                        },
+                        "meta": {
+                          "description": "Optional metadata attached to the schema URI.",
+                          "type": "object",
+                          "propertyNames": {
+                            "type": "string"
+                          },
+                          "additionalProperties": {}
+                        }
+                      },
+                      "additionalProperties": false
+                    }
+                  },
+                  "trustedAuthorities": {
+                    "description": "Optional trusted authority entries.",
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "trustListId": {
+                          "description": "Optional trust list id.",
+                          "type": "string"
+                        },
+                        "frameworkType": {
+                          "description": "Trust framework type. `x509` takes a root certificate in `value` and no `verificationMethod`.",
+                          "type": "string",
+                          "enum": [
+                            "aki",
+                            "etsi_tl",
+                            "openid_federation",
+                            "x509"
+                          ]
+                        },
+                        "value": {
+                          "description": "Framework-specific authority value, for example the trust list URL for `etsi_tl` or the root certificate (base64 DER or PEM) for `x509`.",
+                          "type": "string"
+                        },
+                        "verificationMethod": {
+                          "description": "Verification method descriptor.",
+                          "anyOf": [
+                            {
+                              "type": "object",
+                              "propertyNames": {
+                                "type": "string"
+                              },
+                              "additionalProperties": {}
+                            },
+                            {
+                              "type": "string"
+                            }
+                          ]
+                        }
+                      },
+                      "additionalProperties": false
+                    }
+                  }
+                },
+                "required": [
+                  "version",
+                  "attestationLoS",
+                  "bindingType"
+                ],
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "embeddedDisclosurePolicy": {
+            "description": "Optional embedded disclosure policy.",
+            "anyOf": [
+              {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "policy": {
+                        "type": "string",
+                        "const": "attestationBased",
+                        "description": "Attestation-based policy discriminator."
+                      },
+                      "values": {
+                        "type": "array",
+                        "items": {
+                          "type": "object",
+                          "properties": {
+                            "claims": {
+                              "description": "Claims constraints considered by policy evaluation.",
+                              "type": "array",
+                              "items": {}
+                            },
+                            "credentials": {
+                              "type": "array",
+                              "items": {},
+                              "description": "Credential constraints considered by policy evaluation."
+                            },
+                            "credential_sets": {
+                              "description": "Optional credential set constraints.",
+                              "type": "array",
+                              "items": {}
+                            }
+                          },
+                          "required": [
+                            "credentials"
+                          ],
+                          "additionalProperties": false
+                        },
+                        "description": "Attestation requirements used for policy enforcement."
+                      }
+                    },
+                    "required": [
+                      "policy",
+                      "values"
+                    ],
+                    "additionalProperties": false
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "policy": {
+                        "type": "string",
+                        "const": "none",
+                        "description": "No disclosure policy enforcement."
+                      }
+                    },
+                    "required": [
+                      "policy"
+                    ],
+                    "additionalProperties": false
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "policy": {
+                        "type": "string",
+                        "const": "allowList",
+                        "description": "Allow-list based policy discriminator."
+                      },
+                      "values": {
+                        "type": "array",
+                        "items": {
+                          "type": "string"
+                        },
+                        "description": "Allowed values for policy checks."
+                      }
+                    },
+                    "required": [
+                      "policy",
+                      "values"
+                    ],
+                    "additionalProperties": false
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "policy": {
+                        "type": "string",
+                        "const": "rootOfTrust",
+                        "description": "Root-of-trust policy discriminator."
+                      },
+                      "values": {
+                        "type": "string",
+                        "description": "Root-of-trust identifier or reference."
+                      }
+                    },
+                    "required": [
+                      "policy",
+                      "values"
+                    ],
+                    "additionalProperties": false
+                  }
+                ],
+                "description": "Embedded disclosure policy configuration."
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        },
+        "required": [
+          "id",
+          "config",
+          "fields"
+        ],
+        "additionalProperties": false,
+        "description": "Payload for creating credential issuance configuration.",
+        "$defs": {
+          "__schema0": {
+            "type": "object",
+            "properties": {
+              "path": {
+                "type": "array",
+                "items": {
+                  "type": [
+                    "string",
+                    "number",
+                    "null"
+                  ]
+                },
+                "description": "Path to this claim inside the credential payload."
+              },
+              "type": {
+                "type": "string",
+                "enum": [
+                  "string",
+                  "number",
+                  "integer",
+                  "boolean",
+                  "object",
+                  "array"
+                ],
+                "description": "Data type of the claim value."
+              },
+              "defaultValue": {
+                "description": "Optional default value for this field."
+              },
+              "mandatory": {
+                "description": "Whether the field is required at issuance time.",
+                "type": "boolean"
+              },
+              "disclosable": {
+                "description": "Whether the claim is selectively disclosable.",
+                "type": "boolean"
+              },
+              "namespace": {
+                "description": "Optional namespace for claim grouping.",
+                "type": "string"
+              },
+              "display": {
+                "description": "Localized display metadata for this field.",
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "locale": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Locale tag for the display entry."
+                    },
+                    "name": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Human-readable field name."
+                    },
+                    "description": {
+                      "description": "Optional field description for this locale.",
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "locale",
+                    "name"
+                  ],
+                  "additionalProperties": false
+                }
+              },
+              "constraints": {
+                "description": "Optional JSON Schema 2020-12 validation keywords for the claim value. Only the JSON Schema keywords listed under Constraints in the claims documentation are accepted (validation keywords such as pattern, minLength or enum, subschemas such as items or properties, and annotations); other keys, such as format or $ref, are refused.",
+                "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+              },
+              "children": {
+                "description": "Nested child claim definitions for object or array fields.",
+                "type": "array",
+                "items": {
+                  "$ref": "#/$defs/CredentialConfigCreate/$defs/__schema0"
+                }
+              }
+            },
+            "required": [
+              "path",
+              "type"
+            ],
+            "additionalProperties": false
+          },
+          "ClaimConstraints": {
+            "type": "object",
+            "properties": {
+              "type": {},
+              "enum": {},
+              "const": {},
+              "multipleOf": {},
+              "maximum": {},
+              "exclusiveMaximum": {},
+              "minimum": {},
+              "exclusiveMinimum": {},
+              "maxLength": {},
+              "minLength": {},
+              "pattern": {},
+              "maxItems": {},
+              "minItems": {},
+              "uniqueItems": {},
+              "maxContains": {},
+              "minContains": {},
+              "maxProperties": {},
+              "minProperties": {},
+              "required": {},
+              "dependentRequired": {},
+              "title": {},
+              "description": {},
+              "default": {},
+              "examples": {},
+              "deprecated": {},
+              "readOnly": {},
+              "writeOnly": {},
+              "$comment": {},
+              "items": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "contains": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "additionalProperties": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "propertyNames": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "not": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "if": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "then": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "else": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "unevaluatedItems": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "unevaluatedProperties": {
+                "anyOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                  }
+                ]
+              },
+              "prefixItems": {
+                "type": "array",
+                "items": {
+                  "anyOf": [
+                    {
+                      "type": "boolean"
+                    },
+                    {
+                      "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                    }
+                  ]
+                }
+              },
+              "allOf": {
+                "type": "array",
+                "items": {
+                  "anyOf": [
+                    {
+                      "type": "boolean"
+                    },
+                    {
+                      "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                    }
+                  ]
+                }
+              },
+              "anyOf": {
+                "type": "array",
+                "items": {
+                  "anyOf": [
+                    {
+                      "type": "boolean"
+                    },
+                    {
+                      "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                    }
+                  ]
+                }
+              },
+              "oneOf": {
+                "type": "array",
+                "items": {
+                  "anyOf": [
+                    {
+                      "type": "boolean"
+                    },
+                    {
+                      "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                    }
+                  ]
+                }
+              },
+              "properties": {
+                "type": "object",
+                "propertyNames": {
+                  "type": "string"
+                },
+                "additionalProperties": {
+                  "anyOf": [
+                    {
+                      "type": "boolean"
+                    },
+                    {
+                      "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                    }
+                  ]
+                }
+              },
+              "patternProperties": {
+                "type": "object",
+                "propertyNames": {
+                  "type": "string"
+                },
+                "additionalProperties": {
+                  "anyOf": [
+                    {
+                      "type": "boolean"
+                    },
+                    {
+                      "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                    }
+                  ]
+                }
+              },
+              "dependentSchemas": {
+                "type": "object",
+                "propertyNames": {
+                  "type": "string"
+                },
+                "additionalProperties": {
+                  "anyOf": [
+                    {
+                      "type": "boolean"
+                    },
+                    {
+                      "$ref": "#/$defs/CredentialConfigCreate/$defs/ClaimConstraints"
+                    }
+                  ]
+                }
+              }
+            },
+            "additionalProperties": false
+          }
+        },
+        "title": "CredentialConfigCreate"
+      }
+    }
+  },
+  {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://eudiplo.dev/schemas/v4/IssuanceConfigFile.schema.json",
+    "title": "IssuanceConfigFile",
+    "type": "object",
+    "properties": {
+      "$schema": {
+        "type": "string",
+        "const": "https://eudiplo.dev/schemas/v4/IssuanceConfigFile.schema.json"
+      },
+      "metadata": {
+        "type": "object",
+        "properties": {
+          "generation": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "Monotonically increasing configuration generation."
+          },
+          "ownership": {
+            "type": "string",
+            "enum": [
+              "unmanaged",
+              "file-managed"
+            ],
+            "description": "Requested ownership recorded when the document is applied."
+          }
+        },
+        "additionalProperties": false
+      },
+      "spec": {
+        "$ref": "#/$defs/IssuanceConfig"
+      }
+    },
+    "required": [
+      "$schema",
+      "spec"
+    ],
+    "additionalProperties": false,
+    "$defs": {
+      "IssuanceConfig": {
+        "type": "object",
+        "properties": {
+          "batchSize": {
+            "description": "Optional issuance batch size.",
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 9007199254740991
+          },
+          "dPopRequired": {
+            "description": "Require DPoP proofs for issuance endpoints.",
+            "type": "boolean"
+          },
+          "walletAttestationRequired": {
+            "description": "Default wallet attestation requirement for managed authorization servers.",
+            "type": "boolean"
+          },
+          "walletProviderTrustLists": {
+            "description": "Shared wallet provider trust lists for key attestations and default authorization server wallet authentication.",
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "trustListId": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "url": {
+                  "description": "URL of the wallet provider trust list.",
+                  "type": "string",
+                  "format": "uri"
+                },
+                "verifierKey": {
+                  "description": "Optional verifier key material used for trust list verification.",
+                  "type": "object",
+                  "propertyNames": {
+                    "type": "string"
+                  },
+                  "additionalProperties": {}
+                },
+                "verifierKeyPem": {
+                  "description": "Optional verifier public key in SPKI PEM form (-----BEGIN PUBLIC KEY-----).",
+                  "type": "string",
+                  "pattern": "^\\s*-----BEGIN PUBLIC KEY-----[A-Za-z0-9+/=\\s]+-----END PUBLIC KEY-----\\s*$"
+                },
+                "verifierX509Der": {
+                  "description": "Optional verifier certificate in DER/base64 form.",
+                  "type": "string"
+                }
+              },
+              "additionalProperties": false
+            }
+          },
+          "walletAttestationStatusCheckMode": {
+            "description": "Default status check mode for wallet attestations at managed authorization servers: strict, best_effort (default) or disabled.",
+            "anyOf": [
+              {
+                "type": "string",
+                "enum": [
+                  "strict",
+                  "best_effort",
+                  "disabled"
+                ]
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "signingKeyId": {
+            "description": "Default signing key chain id for credential issuance.",
+            "type": "string",
+            "minLength": 1
+          },
+          "authorizationServers": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "oneOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "external",
+                      "description": "Use an externally managed authorization server."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "issuer": {
+                      "type": "string",
+                      "format": "uri",
+                      "description": "Issuer URL for the external authorization server."
+                    },
+                    "sessionBinding": {
+                      "description": "Explicit mapping from an external access-token claim to an existing issuance session.",
+                      "type": "object",
+                      "properties": {
+                        "method": {
+                          "type": "string",
+                          "const": "access_token_claim",
+                          "description": "Read the correlation value from a configured access-token claim."
+                        },
+                        "claim": {
+                          "type": "string",
+                          "minLength": 1,
+                          "description": "Claim name that contains the issuance-session correlation value."
+                        }
+                      },
+                      "required": [
+                        "method",
+                        "claim"
+                      ],
+                      "additionalProperties": false
+                    },
+                    "label": {
+                      "description": "Optional display label for UI selection.",
+                      "type": "string"
+                    },
+                    "enabled": {
+                      "description": "Whether this authorization server entry is enabled.",
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "id",
+                    "issuer"
+                  ],
+                  "additionalProperties": false
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "oid4vp",
+                      "description": "Use OID4VP-based authorization server chaining."
+                    },
+                    "id": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Authorization server identifier."
+                    },
+                    "presentationConfigId": {
+                      "type": "string",
+                      "minLength": 1,
+                      "description": "Presentation configuration id used during authorization."
+                    },
+                    "immediateWalletRedirect": {
+                      "description": "Redirect wallets immediately after authorization response creation.",
+                      "type": "boolean"
+                    },
+                    "token": {
+                      "description": "Optional token issuance settings.",
+                      "type": "object",
+                      "properties": {
+                        "lifetimeSeconds": {
+                          "description": "Access token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        },
+                        "signingKeyId": {
+                          "description": "Optional key chain id used to sign issued tokens.",
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "refreshTokenEnabled": {
+                          "description": "Enable issuing refresh tokens.",
+                          "type": "boolean"
+                        },
+                        "refreshTokenExpiresInSeconds": {
+                          "description": "Refresh token lifetime in seconds.",
+                          "type": "number",
+                          "minimum": 60
+                        }
+                      },
+                      "additionalProperties": false
+                    },
+                    "requireDPoP": {
+                      "description": "Require DPoP proofs for token/credential requests.",
+                      "type": "boolean"
+                    },
                     "walletAttestationRequired": {
                       "description": "Require wallet attestation for this authorization server.",
                       "type": "boolean"
@@ -38585,6 +39720,7 @@ var CONFIG_SCHEMAS = [
 ];
 
 // ../../packages/eudiplo-config-format/dist/config-validator.js
+var DISPLAY_COLOR_PATH = /^\/spec\/config\/display\/\d+\/(?:background|text)_color$/;
 var ajv = new import__.Ajv2020({
   allErrors: true,
   strict: false,
@@ -38604,7 +39740,7 @@ function validateConfigDocument(document) {
         severity: "error",
         code: "CONFIG_SCHEMA_VALIDATION_FAILED",
         path: issue.instancePath || "/",
-        message: issue.keyword === "additionalProperties" ? `Unknown property: ${String(issue.params.additionalProperty)}` : issue.message ?? "Invalid configuration",
+        message: issue.keyword === "additionalProperties" ? `Unknown property: ${String(issue.params.additionalProperty)}` : issue.keyword === "pattern" && DISPLAY_COLOR_PATH.test(issue.instancePath) ? DISPLAY_COLOR_MESSAGE : issue.message ?? "Invalid configuration",
         resource: { kind: document.kind, id: resourceId(document) }
       });
   }
@@ -38616,8 +39752,21 @@ function validateConfigDocument(document) {
       path: document.kind === "Client" ? "/spec/clientId" : "/spec/id",
       message: "Resource identifier does not match metadata.id"
     });
+  issues.push(...configRuleIssues(document));
   return issues;
 }
+function configRuleIssues(document) {
+  const display = document.spec.config?.display;
+  if (document.kind !== "CredentialConfig" || resolveConfigIdentity(serializeDocument(document)).version < 4 || !Array.isArray(display))
+    return [];
+  return findDuplicateDisplayLocales(display).map((duplicate) => ({
+    severity: "error",
+    code: "DISPLAY_LOCALE_DUPLICATE",
+    path: `/spec/config/display/${duplicate.index}/locale`,
+    message: duplicateDisplayLocaleMessage(duplicate),
+    resource: { kind: document.kind, id: resourceId(document) }
+  }));
+}
 
 // src/commands/config/portability/migrations.ts
 function upgradeDocument(input) {
@@ -39412,11 +40561,11 @@ function pluralize(label, count2) {
 }
 
 // src/commands/config/validate/validator.ts
-var import__2 = __toESM(require__(), 1);
-var import_ajv_formats = __toESM(require_dist(), 1);
 import { existsSync } from "node:fs";
 import { readdir as readdir3, readFile as readFile7 } from "node:fs/promises";
 import { basename as basename4, join as join7 } from "node:path";
+var import__2 = __toESM(require__(), 1);
+var import_ajv_formats = __toESM(require_dist(), 1);
 async function discoverTenantDirectories(rootPath) {
   const entries = await readdir3(rootPath, { withFileTypes: true });
   return entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort((left, right) => left.localeCompare(right));
@@ -39612,6 +40761,27 @@ async function validateResourceFile(filePath, relativeFile, schemaFile, getValid
         metadata: { generation: 1 },
         spec
       };
+      if (kind === "CredentialConfig") {
+        let issues;
+        try {
+          issues = validateConfigDocument(
+            normalizeDocument(resolved)
+          );
+        } catch (error) {
+          errors.push({
+            file: relativeFile,
+            message: error.message
+          });
+          return false;
+        }
+        for (const issue of issues)
+          errors.push({
+            file: relativeFile,
+            path: issue.path,
+            message: issue.message
+          });
+        if (issues.length) return false;
+      }
     }
   }
   const validate = getValidator(schemaFile);
@@ -41361,7 +42531,7 @@ function createDeploymentCommands(context, setExitCode) {
 // package.json
 var package_default = {
   name: "@eudiplo/cli",
-  version: "9.1.0-main.8be8b4e",
+  version: "9.1.0-main.8e6a2ad",
   description: "Deployment-aware command line tools for EUDIPLO",
   private: false,
   type: "module",