@goodandready/dsh-subscriptions 0.6.82 → 0.6.83

package/README.md

@@ -309,6 +309,7 @@ dsh-subscriptions:
 
 - `customVendors.authUrl`, `tokenUrl` and `baseUrl` must use `https://`. Plain `http://` is accepted only for loopback hosts (`localhost`, `127.0.0.1`, `::1`).
 - Grok `baseUrl` overrides must point to `api.x.ai`, `grok.com` / `*.grok.com`, or a loopback host; other hosts are rejected with `GROK_UNTRUSTED_HOST` so bearer tokens never leave trusted xAI infrastructure.
+- Antigravity CLI imports must configure `antigravityClientSecret`; the embedded default was removed.
 - The error buffer and diagnostics reports redact bearer tokens, API keys, JWTs and `key=value` credentials before storing or returning them.
 
 

package/README.ru.md

@@ -282,6 +282,7 @@ dsh-subscriptions:
 
 - `customVendors.authUrl`, `tokenUrl` и `baseUrl` обязаны использовать `https://`. Открытый `http://` допускается только для loopback-хостов (`localhost`, `127.0.0.1`, `::1`).
 - Переопределение Grok `baseUrl` должно указывать на `api.x.ai`, `grok.com` / `*.grok.com` или loopback-хост; остальные хосты отклоняются с `GROK_UNTRUSTED_HOST`, чтобы bearer-токен не покидал доверенную инфраструктуру xAI.
+- Импорт Antigravity CLI требует явного `antigravityClientSecret`; встроенный default удалён.
 - Error buffer и диагностические отчёты редактируют bearer-токены, API-ключи, JWT и `key=value`-credentials до сохранения и выдачи.
 
 

package/README.zh.md

@@ -188,6 +188,7 @@ dsh plugin --profile web add @goodandready/dsh-subscriptions
 
 - `customVendors.authUrl`、`tokenUrl` 和 `baseUrl` 必须使用 `https://`。明文 `http://` 仅允许用于回环主机（`localhost`、`127.0.0.1`、`::1`）。
 - Grok `baseUrl` 覆盖只能指向 `api.x.ai`、`grok.com` / `*.grok.com` 或回环主机；其他主机会以 `GROK_UNTRUSTED_HOST` 拒绝，避免 bearer 令牌离开可信的 xAI 基础设施。
+- Antigravity CLI 导入必须配置 `antigravityClientSecret`；内置默认值已移除。
 - 错误缓冲区和诊断报告会在存储或返回前脱敏 bearer 令牌、API 密钥、JWT 和 `key=value` 凭据。
 
 

package/lib/blob.js

@@ -90,3 +90,7 @@ export function parseBlob(text) {
     ...(obj.usageAt ? { usageAt: Number(obj.usageAt) } : {}),
   }
 }
+
+export function validateCredentialBlob(blob) {
+  return parseBlob(serializeBlob(blob))
+}

package/lib/config-schema.js

@@ -285,3 +285,7 @@ export function restoreMaskedSecrets(incoming, existing) {
 
   return out
 }
+
+export function revisionOf(settingsApi) {
+  return settingsApi && typeof settingsApi.revision === 'function' ? settingsApi.revision() : undefined
+}

package/lib/headless-auth.js

@@ -326,6 +326,15 @@ export function getHeadlessAuthInfo({ provider = '', redirectUri = '', authUrl =
   }
 }
 
+export function safePostMessageOrigin(originHeader) {
+  try {
+    const u = new URL(String(originHeader || ''))
+    if (u.protocol === 'http:' || u.protocol === 'https:') return u.origin
+    if (u.protocol === 'dsh-app:') return 'dsh-app://' + u.host
+  } catch { /* invalid origin */ }
+  return ''
+}
+
 export async function handleHeadlessRedirect(req, res, { pending, completeOAuth, accountsView }) {
   const rawUrl = new URL(req.url || '/', 'http://127.0.0.1')
   const code = rawUrl.searchParams.get('code') || ''
@@ -353,11 +362,15 @@ export async function handleHeadlessRedirect(req, res, { pending, completeOAuth,
     try {
       await completeOAuth({ provider: row.provider, index: row.index, code, state })
       if (typeof accountsView === 'function') await accountsView()
+      const targetOrigin = safePostMessageOrigin(req && req.headers && req.headers.origin)
+      const relay = targetOrigin
+        ? `<script>if (window.opener) { window.opener.postMessage({ type: 'dsh-oauth-success', state: ${JSON.stringify(String(state))} }, ${JSON.stringify(targetOrigin)}); }</script>`
+        : ''
       res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' })
       res.end(`<!doctype html><meta charset="utf-8"><title>Subscriptions</title><body style="font-family:sans-serif;padding:2rem;">` +
         `<h2 style="color:#2e7d32;">Signed In Successfully</h2>` +
         `<p>Your account has been authorized. You can close this window and return to Settings.</p>` +
-        `<script>if (window.opener) { window.opener.postMessage({ type: 'dsh-oauth-success', state: '${escapeHtml(state)}' }, '*'); }</script>` +
+        relay +
         `</body>`)
       return
     } catch (e) {

package/lib/http.js

@@ -79,7 +79,34 @@ export function isLoopback(value) {
 
 
 
+function hostNameOf(hostHeader) {
+  const raw = String(Array.isArray(hostHeader) ? (hostHeader[0] || '') : (hostHeader || '')).trim().toLowerCase()
+  if (!raw) return ''
+  if (raw === '::1') return '::1'
+  if (raw.startsWith('[')) {
+    const end = raw.indexOf(']')
+    return end > 0 ? raw.slice(0, end + 1) : raw
+  }
+  return raw.split(':')[0]
+}
+
+function configuredTrustedHosts(targetCtx) {
+  const out = new Set()
+  for (const part of String(process.env.DSH_TRUSTED_HOSTS || '').split(',')) {
+    const host = hostNameOf(part)
+    if (host) out.add(host)
+  }
+  try {
+    const url = targetCtx && targetCtx.webServer && targetCtx.webServer.url
+    if (url) out.add(hostNameOf(new URL(url).host))
+  } catch { /* ignore malformed web server url */ }
+  return out
+}
+
 /**
+ * @param {import('node:http').IncomingMessage} request
+ * @param {any} [targetCtx]
+ * @returns {boolean}/**
  * @param {import('node:http').IncomingMessage} request
  * @param {any} [targetCtx]
  * @returns {boolean}
@@ -148,6 +175,20 @@ export function isTrustedSettingsRequest(request, targetCtx) {
     }
   }
 
+  // 4a. Loopback peers must present a loopback or configured Host.
+  // A loopback socket with a foreign Host is a DNS-rebinding attempt.
+  const peerAddress = request?.socket?.remoteAddress || request?.connection?.remoteAddress
+  if (peerAddress && isLoopback(peerAddress)) {
+    const host = hostNameOf(headers.host)
+    const loopbackHost = host === ''
+      || host === 'localhost'
+      || host === 'localhost.'
+      || host === '127.0.0.1'
+      || host === '::1'
+      || host === '[::1]'
+    if (!loopbackHost && !configuredTrustedHosts(targetCtx).has(host)) return false
+  }
+
   // 4. Delegate to DSH connection service if available (#374)
   let conn = null
   try {

package/lib/import-auth.js

@@ -6,7 +6,7 @@ import { readClaudeCredentials } from './vendors/claude-cli.js'
 import { readCopilotCredentials } from './vendors/copilot-cli.js'
 import { normalizeExpiresAt } from './blob.js'
 import { isGoogleClientId, extractGoogleClientIdFromJwt, emailFromToken } from './jwt.js'
-import { DEFAULT_CLI_CLIENT_ID, DEFAULT_CLI_CLIENT_SECRET } from './vendors/antigravity.js'
+
 
 // Test seam: a fixture root overrides the real home for the duration of a
 // public call. Undefined (the default) keeps production behaviour.
@@ -146,7 +146,8 @@ async function discoverLocalCliSessionsInner() {
     }
   }
 
-  if (!detected.antigravity && (process.platform === 'win32' || activeWindowsCredentialReader)) {
+  const canReadWindowsCredentialManager = Boolean(activeWindowsCredentialReader) || (!activeHome && process.platform === 'win32')
+  if (!detected.antigravity && canReadWindowsCredentialManager) {
     const winCred = readWindowsAntigravityCredential()
     const tok = winCred && winCred.token ? winCred.token : winCred
     if (tok && (tok.access_token || tok.accessToken)) {
@@ -453,10 +454,6 @@ export async function loadLocalCliBlob(provider, options = {}) {
       raw.installed?.client_secret || raw.web?.client_secret || ''
     let clientSecret = typeof directSecret === 'string' ? directSecret.trim() : ''
 
-    if (!clientSecret && clientId === DEFAULT_CLI_CLIENT_ID) {
-      clientSecret = DEFAULT_CLI_CLIENT_SECRET
-    }
-
     const rawExpiry = tok.expiry ?? tok.expires_at ?? tok.expiresAt ?? tok.expiry_date ?? raw.expiry_date ?? raw.expiry ?? (tok.expires_in ? Date.now() + Number(tok.expires_in) * 1000 : 0)
     const expiresAt = normalizeExpiresAt(rawExpiry)
 

package/lib/index.js

@@ -135,6 +135,7 @@ export function apply(ctx, rawConfig) {
 
   const settingsApi = {
     get: () => live(),
+    revision: () => describeRow()?.revision,
     replace: async (next, expectedRevision) => {
       const parsed = plainConfig(next)
       const prevConfig = cachedConfig

package/lib/routes/accounts.js

@@ -4,10 +4,11 @@ import { syncVaultPush, syncVaultPull, getVaultSyncStatus } from '../vault-sync.
 import { normalizeSlots, vendorConfig } from '../accounts.js'
 import { getVendor } from '../vendors/index.js'
 import { notifyQuarantineEntered, notifyQuarantineReleased } from '../alerts.js'
-import { Config, plainConfig, publicConfig } from '../config-schema.js'
+import { Config, plainConfig, publicConfig, revisionOf } from '../config-schema.js'
 import { decryptWithPassphrase, encryptWithPassphrase } from '../crypto.js'
 import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson } from '../http.js'
 import { discoverLocalCliSessions, loadLocalCliBlob } from '../import-auth.js'
+import { validateCredentialBlob } from '../blob.js'
 import { isProvider, oauthRef, parseOauthRef } from '../refs.js'
 
 export function registerAccountsRoutes(ctx, state) {
@@ -276,18 +277,20 @@ export function registerAccountsRoutes(ctx, state) {
         const curSlots = Array.isArray(live().slots) ? live().slots.slice() : []
         const exists = curSlots.some((s) => s && s.provider === prov && Number(s.index) === idx)
         if (!exists && getSettingsApi()) {
+          const settings = getSettingsApi()
+          const revision = revisionOf(settings)
           const nextSlots = curSlots.concat([{
             provider: prov,
             index: idx,
             label: blob.email || '',
           }])
           const parsed = plainConfig(Config({ ...live(), slots: stripLegacySlots(nextSlots) }))
-          await getSettingsApi().replace(parsed)
+          await settings.replace(parsed, revision)
           syncCustomVendors()
         }
         const slot = normalizeSlots(live().slots).find((s) => s.provider === prov && s.index === idx)
         const ref = slot ? slot.ref : oauthRef(prov, idx)
-        await store.saveBlob(ref, blob)
+        await store.saveBlob(ref, validateCredentialBlob(blob))
         await syncAdapter()
         refreshModels().catch(() => {})
         writeJson(res, 200, {
@@ -389,7 +392,7 @@ export function registerAccountsRoutes(ctx, state) {
       for (const row of bundle.accounts) {
         try {
           if (!row || typeof row.ref !== 'string' || !parseOauthRef(row.ref) || !row.blob) continue
-          await store.saveBlob(row.ref, row.blob)
+          await store.saveBlob(row.ref, validateCredentialBlob(row.blob))
           imported++
         } catch { /* skip broken */ }
       }
@@ -437,7 +440,7 @@ export function registerAccountsRoutes(ctx, state) {
         const ref = oauthRef(provider, index)
         const blob = { accessToken: apiKey || refreshToken, refreshToken: refreshToken || apiKey }
         if (apiKey) { blob.apiKey = apiKey; blob.apiKeyOnly = true }
-        await store.saveBlob(ref, blob)
+        await store.saveBlob(ref, validateCredentialBlob(blob))
         await syncAdapter()
         refreshModels().catch(() => {})
         writeJson(res, 200, { ok: true, ref, accounts: await accountsView() })
@@ -674,6 +677,7 @@ export function registerAccountsRoutes(ctx, state) {
     try {
       const result = importVault(vault, passphrase)
       const settings = getSettingsApi()
+      const revision = revisionOf(settings)
       let parsed
       if (result.slots.length) {
         if (!settings) throw new Error('settings are unavailable for vault import')
@@ -690,11 +694,11 @@ export function registerAccountsRoutes(ctx, state) {
       }
       let blobCount = 0
       for (const [ref, blob] of Object.entries(result.blobs)) {
-        await store.saveBlob(ref, blob)
+        await store.saveBlob(ref, validateCredentialBlob(blob))
         blobCount++
       }
       if (parsed) {
-        await settings.replace(parsed)
+        await settings.replace(parsed, revision)
         syncCustomVendors()
       }
       await syncAdapter()

package/lib/routes/oauth.js

@@ -301,6 +301,13 @@ export function registerOauthRoutes(ctx, state) {
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-subscriptions/oauth/headless-redirect',
-    handler: (req, res) => handleHeadlessRedirect(req, res, { pending, completeOAuth, accountsView }),
+    handler: (req, res) => {
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        res.writeHead(403, { 'Content-Type': 'text/html; charset=utf-8' })
+        res.end('<!doctype html><meta charset="utf-8"><p>Forbidden: same-origin or loopback requests only.</p>')
+        return
+      }
+      return handleHeadlessRedirect(req, res, { pending, completeOAuth, accountsView })
+    },
   }), 'dsh-subscriptions: /oauth/headless-redirect')
 }

package/lib/subscriptions.js

@@ -5,16 +5,39 @@ import { pickFetch } from "./proxy.js"
 import { fetchWithTimeout } from "./http.js"
 
 // ponytail: allowlist per provider — add path to extend without touching request logic
+const OPENAI_COMPAT = [
+  "/models",
+  "/v1/models",
+  "/chat/completions",
+  "/v1/chat/completions",
+  "/responses",
+  "/v1/responses",
+  "/images/generations",
+  "/v1/images/generations",
+]
+
 export const ALLOWLIST = {
   codex: ["/responses", "/models", "/images/generations", "/backend-api/codex/responses", "/backend-api/codex/models", "/backend-api/codex/images/generations"],
   claude: ["/v1/messages", "/api/oauth/profile", "/api/oauth/usage", "/v1/models"],
   grok: ["/v1/models", "/responses", "/v1/responses", "/v1/billing", "/v1/chat/completions", "/images/generations", "/v1/images/generations"],
   antigravity: ["/v1/models", "/v1/generateContent", "/v1/streamGenerateContent", "/v1/loadCodeAssist", "/v1/fetchAvailableModels", "/v1/countTokens", "/v1/internal:loadCodeAssist"],
+  kimi: OPENAI_COMPAT,
+  glm: [...OPENAI_COMPAT, "/api/paas/v4/chat/completions", "/api/paas/v4/models"],
+  cursor: OPENAI_COMPAT,
+  kiro: OPENAI_COMPAT,
+  copilot: OPENAI_COMPAT,
+  qwen: [...OPENAI_COMPAT, "/compatible-mode/v1/chat/completions", "/compatible-mode/v1/models"],
+  ernie: [...OPENAI_COMPAT, "/rpc/2.0/ai_custom/v1/wenxinworkshop/chat", "/oauth/2.0/token"],
+  spark: OPENAI_COMPAT,
+  jetbrains: OPENAI_COMPAT,
+  perplexity: [...OPENAI_COMPAT, "/api/v1/user/profile", "/api/v1/user/usage"],
+  replit: [...OPENAI_COMPAT, "/api/v1/ai"],
+  cody: OPENAI_COMPAT,
 }
 
 export function isAllowed(provider, path) {
   if (!isProvider(provider)) return false
-  const list = ALLOWLIST[provider] || []
+  const list = ALLOWLIST[provider] || OPENAI_COMPAT
   let p = String(path || "")
   // strip query and hash
   p = p.split("?")[0].split("#")[0]

package/lib/vault-sync.js

@@ -4,7 +4,8 @@
 import { createHmac, createHash } from 'node:crypto'
 import { exportVault, importVault } from './vault.js'
 import { normalizeSlots } from './accounts.js'
-import { Config, plainConfig } from './config-schema.js'
+import { Config, plainConfig, revisionOf } from './config-schema.js'
+import { validateCredentialBlob } from './blob.js'
 
 let syncStatus = {
   enabled: false,
@@ -368,6 +369,7 @@ export async function syncVaultPull({ live, store, settingsApi, syncAdapter, ref
 
     // Merge slots into live configuration
     if (result.slots.length && settingsApi) {
+      const revision = revisionOf(settingsApi)
       const curSlots = Array.isArray(cfg.slots) ? cfg.slots.slice() : []
       for (const s of result.slots) {
         const idx = curSlots.findIndex((c) => c.provider === s.provider && Number(c.index) === Number(s.index))
@@ -378,13 +380,13 @@ export async function syncVaultPull({ live, store, settingsApi, syncAdapter, ref
         }
       }
       const parsed = plainConfig(Config({ ...cfg, slots: curSlots }))
-      await settingsApi.replace(parsed)
+      await settingsApi.replace(parsed, revision)
     }
 
     // Save blobs into store
     let blobCount = 0
     for (const [ref, blob] of Object.entries(result.blobs)) {
-      await store.saveBlob(ref, blob)
+      await store.saveBlob(ref, validateCredentialBlob(blob))
       blobCount++
     }
 

package/lib/vendors/antigravity.js

@@ -18,7 +18,7 @@ import {
 
 export const id = 'antigravity'
 export const DEFAULT_CLI_CLIENT_ID = ['681255809395', 'oo8ft2oprdrnp9e3aqf6av3hmdib135j'].join('-') + '.' + 'apps.googleusercontent.com'
-export const DEFAULT_CLI_CLIENT_SECRET = ['GOCSPX', '4uHgMPm', '1o7Sk', 'geV6Cu5clXFsxl'].join('-')
+
 
 const AUTH = 'https://accounts.google.com/o/oauth2/v2/auth'
 const TOKEN = 'https://oauth2.googleapis.com/token'
@@ -143,7 +143,7 @@ export async function refresh(cfg, blob, fetchImpl) {
   let clientSecret = (cfg?.clientSecret && String(cfg.clientSecret).trim()) || (blob?.clientSecret && String(blob.clientSecret).trim()) || ''
 
   if (!clientSecret && clientId === DEFAULT_CLI_CLIENT_ID) {
-    clientSecret = DEFAULT_CLI_CLIENT_SECRET
+    throw new Error('Google OAuth refresh requires a client secret for the default Gemini CLI client. Configure antigravityClientSecret in plugin settings.')
   }
 
   if (!clientId) {

package/lib/vendors/copilot-cli.js

@@ -8,6 +8,13 @@ import { join, delimiter } from 'node:path'
 import { spawn } from 'node:child_process'
 import { LlmError } from '@deepseek-ai/dsh-llm'
 
+const MAX_STDERR_CHARS = 2048
+const GITHUB_TOKEN_PATTERN = /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/g
+
+export function redactCopilotStderr(text) {
+  return String(text || '').replace(GITHUB_TOKEN_PATTERN, '[REDACTED]')
+}
+
 /**
  * Standard candidate binary names for GitHub Copilot CLI.
  */
@@ -144,8 +151,11 @@ export function findCopilotCli(customPath, env = process.env, platform = process
     )
   }
 
+  const candidates = platform === 'win32'
+    ? COPILOT_CLI_BINARIES.filter((bin) => /\.(cmd|exe|bat)$/i.test(bin))
+    : COPILOT_CLI_BINARIES.filter((bin) => !/\.(cmd|exe|bat)$/i.test(bin))
   for (const dir of pathDirs) {
-    for (const bin of COPILOT_CLI_BINARIES) {
+    for (const bin of candidates) {
       const fullPath = join(dir, bin)
       try {
         if (existsSync(fullPath)) {
@@ -232,6 +242,16 @@ export function prepareCopilotCliInvocation(options, blob = {}, _binaryPath = 'c
   return { args, env, inputPayload }
 }
 
+export function resolveSpawnCommand(binaryPath, args, platform = process.platform) {
+  if (platform === 'win32' && /\.(cmd|bat)$/i.test(String(binaryPath))) {
+    return {
+      command: process.env.ComSpec || 'cmd.exe',
+      args: ['/d', '/s', '/c', binaryPath, ...args],
+    }
+  }
+  return { command: binaryPath, args }
+}
+
 /**
  * Stream execution from local Copilot CLI process.
  * Yields canonical DSH events: block-start, text-delta, tool-call-delta, finish, usage.
@@ -251,10 +271,11 @@ export async function* streamCopilotCli({ binaryPath, options, blob, config: _co
 
   const { args, env, inputPayload } = prepareCopilotCliInvocation(options, blob, binaryPath)
   const spawner = spawnImpl || spawn
+  const invocation = resolveSpawnCommand(binaryPath, args)
 
   let child
   try {
-    child = spawner(binaryPath, args, {
+    child = spawner(invocation.command, invocation.args, {
       env,
       stdio: ['pipe', 'pipe', 'pipe'],
     })
@@ -285,7 +306,10 @@ export async function* streamCopilotCli({ binaryPath, options, blob, config: _co
   let stderrBuffer = ''
 
   if (child.stderr) {
-    child.stderr.on('data', (d) => { stderrBuffer += d.toString() })
+    child.stderr.on('data', (d) => {
+      if (stderrBuffer.length >= MAX_STDERR_CHARS) return
+      stderrBuffer += String(d).slice(0, MAX_STDERR_CHARS - stderrBuffer.length)
+    })
   }
 
   const chunkQueue = []
@@ -326,7 +350,7 @@ export async function* streamCopilotCli({ binaryPath, options, blob, config: _co
       stdoutBuffer = ''
     }
     if (code !== 0 && !chunkQueue.length) {
-      processError = new LlmError(`Copilot CLI exited with code ${code}: ${stderrBuffer.trim() || 'unknown error'}`, 'VENDOR')
+      processError = new LlmError(`Copilot CLI exited with code ${code}: ${redactCopilotStderr(stderrBuffer.trim()) || 'unknown error'}`, 'VENDOR')
     }
     if (resolveNext) {
       const r = resolveNext

package/lib/vendors/jetbrains.js

@@ -83,12 +83,15 @@ export function defaults() {
 export function authorizeUrl(cfg = {}, pkce = {}) {
   const c = cfg || {}
   const p = pkce || {}
+  if (!p.challenge || !p.state) {
+    throw new Error('JetBrains OAuth requires PKCE challenge and state')
+  }
   return buildAuthorizeUrl({
     authUrl: AUTH,
     clientId: c.clientId || defaults().clientId,
     redirectUri: c.redirectUri || defaults().redirectUri,
-    challenge: p.challenge || 'challenge',
-    state: p.state || 'state',
+    challenge: p.challenge,
+    state: p.state,
     scope: SCOPE,
   })
 }

package/lib/vendors/perplexity.js

@@ -77,12 +77,15 @@ export function defaults() {
 export function authorizeUrl(cfg = {}, pkce = {}) {
   const c = cfg || {}
   const p = pkce || {}
+  if (!p.challenge || !p.state) {
+    throw new Error('Perplexity OAuth requires PKCE challenge and state')
+  }
   return buildAuthorizeUrl({
     authUrl: AUTH,
     clientId: c.clientId || defaults().clientId,
     redirectUri: c.redirectUri || defaults().redirectUri,
-    challenge: p.challenge || 'challenge',
-    state: p.state || 'state',
+    challenge: p.challenge,
+    state: p.state,
     scope: SCOPE,
   })
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.82",
+  "version": "0.6.83",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",