brightspace-mcp-server 3.11.15 → 3.12.1

package/README.md

@@ -96,6 +96,7 @@ All optional, set in your AI app's MCP `env` config or your shell. The full list
 | Setting | What it does |
 |---------|--------------|
 | `D2L_REMEMBER_MFA=true` | Tick Microsoft's "Don't ask again" box so later sign-ins skip the second factor (off by default; not for shared computers). `setup` asks this and saves it as `rememberMfa` in `config.json`; the env var overrides it |
+| `D2L_PASSWORDLESS=true` | Sign in with Microsoft Entra's passwordless phone approval, so no password is saved on the computer (off by default; Entra schools only). Every sign-in, including automatic ones, then waits for you to approve on your phone, so it suits interactive use, not unattended or scheduled jobs. `setup` asks this and saves it as `passwordless` in `config.json`; the env var overrides it ([details](docs/sign-in.md#passwordless-sign-in)) |
 | `D2L_HEADLESS=false` | Show the browser window during sign-in, for MFA methods that need a click |
 | `D2L_DUO_PASSCODE=1` | On Duo, type a passcode instead of waiting for a push |
 | `D2L_SESSION_COOKIE` / `D2L_ACCESS_TOKEN` | Skip the browser entirely with a pasted cookie or token ([how](docs/sign-in.md#no-browser-paste-a-session-cookie-or-token)) |

package/build/api/paginate.js

@@ -48,6 +48,7 @@ export async function fetchAllItems(apiClient, firstPath, options) {
 }
 /**
  * Every object across every page of a { Objects, Next } endpoint, in order.
+ * A bare array response is taken as the complete list.
  *
  * Next arrives either as a full next-page URL or as a bare bookmark, so the
  * absolute form is reduced to its path and query and anything else is treated
@@ -65,6 +66,11 @@ export async function fetchAllObjects(apiClient, firstPath, options) {
         }
         const response = await apiClient.get(path, options);
         pages += 1;
+        // Some tenants answer a paged route with a bare array: that is the whole list.
+        if (Array.isArray(response)) {
+            objects.push(...response);
+            break;
+        }
         objects.push(...(response?.Objects ?? []));
         const next = response?.Next;
         if (!next)

package/build/auth/browser-auth.js

@@ -38,6 +38,9 @@ const SILENT_SSO = {
     // text fallback covers a tenant that renames the id.
     passwordSwitch: "#idA_PWD_SwitchToPassword",
     passwordSwitchText: "Use your password instead",
+    // The approval view's own markers (purdue-sso.ts PASSWORDLESS_APPROVAL_SELECTORS),
+    // for a tenant that shows it without the password link.
+    passwordlessApproval: ["#idRemoteNGC_DisplaySign", "#idDiv_RemoteNGC_PollingDescription"],
 };
 export class BrowserAuthTransportError extends Error {
     code = "AUTH_TRANSPORT";
@@ -535,9 +538,17 @@ export class BrowserAuth {
         const byText = page.getByText(SILENT_SSO.passwordSwitchText).first();
         return await byText.isVisible().catch(() => false) ? byText : null;
     }
-    /** One definition of the MFA pages the shared authentication loop supports. */
+    /**
+     * One definition of the MFA pages the shared authentication loop supports.
+     * With passwordless sign-in on, Microsoft's approval view is the challenge
+     * itself, so the silent poll stays on it instead of taking the password link.
+     */
     async hasMfaChallenge(page) {
-        return isDuoPrompt(page) || await this.isAnyOnScreen(page, SILENT_SSO.mfaChallenges);
+        if (isDuoPrompt(page) || await this.isAnyOnScreen(page, SILENT_SSO.mfaChallenges))
+            return true;
+        if (!this.config.passwordless)
+            return false;
+        return await this.isAnyOnScreen(page, SILENT_SSO.passwordlessApproval) || await this.passwordSignInOption(page) !== null;
     }
     /**
      * A POSITIVE session check, never "the URL doesn't look like a login page".

package/build/auth/credential-store.js

@@ -172,6 +172,17 @@ export async function setStoredPassword(baseUrl, username, password, backend = n
         throw new NativeCredentialStoreError("The saved password could not be verified in the native credential store. Existing configuration was preserved.");
     }
 }
+/** Remove an account's saved password, so passwordless sign-in leaves none behind. */
+export async function deleteStoredPassword(baseUrl, username, backend = nativeCredentialBackend) {
+    const account = passwordAccount(baseUrl, username);
+    // Some native stores raise on deleting an entry that does not exist.
+    if (await backend.getPassword(SERVICE, account) === null)
+        return;
+    await backend.deletePassword(SERVICE, account);
+    if (await backend.getPassword(SERVICE, account) !== null) {
+        throw new NativeCredentialStoreError("The saved password could not be removed from the native credential store. Existing configuration was preserved.");
+    }
+}
 function decodeKey(value) {
     if (!/^[a-f0-9]{64}$/i.test(value)) {
         throw new NativeCredentialStoreError("The saved session encryption key is invalid. Restore its native credential store entry before retrying.");

package/build/auth/purdue-sso.js

@@ -22,6 +22,20 @@ const FIELD_POLL_MS = 250;
  * logged. Plain DOM text, no OCR.
  */
 const NUMBER_MATCH_SELECTOR = "#idRichContext_DisplaySign";
+/**
+ * Microsoft's passwordless phone sign-in view ("Approve sign in request"),
+ * which the tenant shows instead of a password page once the account has
+ * registered passwordless sign-in in Authenticator. The "Use your password
+ * instead" link is the marker browser-auth.ts already relies on; the
+ * RemoteNGC ids are EXPECTED, not verified against a live tenant from here.
+ * The number shown there is typed into Authenticator like number match.
+ */
+const PASSWORDLESS_NUMBER_SELECTOR = "#idRemoteNGC_DisplaySign";
+const PASSWORDLESS_APPROVAL_SELECTORS = [
+    PASSWORDLESS_NUMBER_SELECTOR,
+    "#idDiv_RemoteNGC_PollingDescription",
+    "#idA_PWD_SwitchToPassword",
+];
 const MFA_CODE_SELECTORS = ["#idTxtBx_SAOTCC_OTC", 'input[name="otc"]'];
 const MFA_CODE_SUBMIT_SELECTORS = ["#idSubmit_SAOTCC_Continue", "#idSIButton9"];
 // Entra rejects a wrong code in place: the field stays and this message appears.
@@ -118,7 +132,7 @@ export class PurdueSSOFlow {
      * Returns true if credentials are available for automated SSO login.
      */
     hasCredentials() {
-        return Boolean(this.config.username && this.config.password);
+        return Boolean(this.config.username && (this.config.password || this.config.passwordless));
     }
     /** What Entra's "Don't ask again" checkbox did, once its MFA page has appeared. */
     rememberMfaResult() {
@@ -195,7 +209,7 @@ export class PurdueSSOFlow {
     async enterCredentials(page) {
         if (!this.config.username)
             throw new BrowserAuthError("Username is required for SSO login", "credentials");
-        if (!this.config.password)
+        if (!this.config.password && !this.config.passwordless)
             throw new BrowserAuthError("Password is required for SSO login", "credentials");
         log("INFO", "Entering credentials");
         // A submitted account hint only counts once Microsoft has actually left the
@@ -225,7 +239,7 @@ export class PurdueSSOFlow {
             // browser-auth.ts), so this only takes the single-page branch once the
             // field survives two consecutive checks.
             if (await this.hasCoVisiblePassword(page)) {
-                if (!await this.fillWhenReady(page, PASSWORD_SELECTORS, this.config.password)) {
+                if (!await this.fillWhenReady(page, PASSWORD_SELECTORS, this.savedPassword())) {
                     throw new UnsupportedAuthenticationError("The identity provider's password field did not appear. Automatic sign-in cannot continue.");
                 }
                 if (!await this.clickWhenReady(page, SUBMIT_SELECTORS)) {
@@ -236,14 +250,29 @@ export class PurdueSSOFlow {
             if (!await this.clickWhenReady(page, SUBMIT_SELECTORS)) {
                 throw new UnsupportedAuthenticationError("The identity provider's username submit button did not appear. Automatic sign-in cannot continue.");
             }
+            // Passwordless: Microsoft answers the username with its approval view,
+            // which handleMFA waits on like any other phone approval.
+            if (!this.config.password)
+                return;
         }
-        if (!await this.fillWhenReady(page, PASSWORD_SELECTORS, this.config.password)) {
+        if (!await this.fillWhenReady(page, PASSWORD_SELECTORS, this.savedPassword())) {
             throw new UnsupportedAuthenticationError("The identity provider's password field did not appear. Automatic sign-in cannot continue.");
         }
         if (!await this.clickWhenReady(page, SUBMIT_SELECTORS)) {
             throw new UnsupportedAuthenticationError("The identity provider's password submit button did not appear. Automatic sign-in cannot continue.");
         }
     }
+    /**
+     * The saved password, or a clear failure when passwordless sign-in left
+     * none to type: a tenant can still ask for one (an unregistered method, a
+     * policy change), and waiting on a field nothing can fill would only time out.
+     */
+    savedPassword() {
+        if (this.config.password)
+            return this.config.password;
+        throw new UnsupportedAuthenticationError("Microsoft asked for a password, but passwordless sign-in is on (D2L_PASSWORDLESS, or passwordless in config.json), so none is saved. " +
+            "Register passwordless phone sign-in in Microsoft Authenticator, or turn passwordless off and save a password with setup.");
+    }
     /** Ported from Brightspace Bar's proven four-step Entra choreography. */
     async actWhenReady(page, selectors, act) {
         const deadline = Date.now() + FIELD_TIMEOUT_MS;
@@ -307,6 +336,7 @@ export class PurdueSSOFlow {
             "#idDiv_SAOTCC_Title",
             "#KmsiCheckboxField",
             ...MFA_CODE_SELECTORS,
+            ...PASSWORDLESS_APPROVAL_SELECTORS,
         ]);
     }
     /** Brightspace Bar's bounded number/auth/KMSI polling loop. */
@@ -350,7 +380,11 @@ export class PurdueSSOFlow {
                     sawNumber = true;
                 const challengeVisible = number !== null ||
                     await page.locator("#idDiv_SAOTCAS_Title").first().isVisible().catch(() => false) ||
-                    await page.locator("#idDiv_SAOTCC_Title").first().isVisible().catch(() => false);
+                    await page.locator("#idDiv_SAOTCC_Title").first().isVisible().catch(() => false) ||
+                    await this.anyVisible(page, PASSWORDLESS_APPROVAL_SELECTORS);
+                // With no password saved, a password page can only end in a timeout.
+                if (this.config.passwordless && !this.config.password && !challengeVisible && await this.isPasswordOnlyPage(page))
+                    this.savedPassword();
                 // The checkbox can render after the heading or number. Recheck during
                 // the existing poll without delaying the first challenge announcement.
                 if (challengeVisible)
@@ -649,13 +683,16 @@ export class PurdueSSOFlow {
     }
     /** The digits on screen, or null when Entra is not showing any. */
     async readNumberMatch(page) {
-        const sign = page.locator(NUMBER_MATCH_SELECTOR).first();
-        // isVisible answers immediately rather than waiting out a timeout, so the
-        // runs that never show a number keep the poll on its two-second rhythm.
-        if (!(await sign.isVisible().catch(() => false)))
-            return null;
-        const text = await sign.textContent().catch(() => null);
-        const number = text?.trim();
-        return number && /^\d{1,3}$/.test(number) ? number : null;
+        for (const selector of [NUMBER_MATCH_SELECTOR, PASSWORDLESS_NUMBER_SELECTOR]) {
+            const sign = page.locator(selector).first();
+            // isVisible answers immediately rather than waiting out a timeout, so the
+            // runs that never show a number keep the poll on its two-second rhythm.
+            if (!(await sign.isVisible().catch(() => false)))
+                continue;
+            const text = await sign.textContent().catch(() => null);
+            const number = text?.trim();
+            return number && /^\d{1,3}$/.test(number) ? number : null;
+        }
+        return null;
     }
 }

package/build/auth/sso-flow.js

@@ -47,6 +47,7 @@ export function createSSOFlow(config, requestMfaCode, onMfaChallenge) {
         baseUrl: config.baseUrl,
         headless: config.headless,
         rememberMfa: config.rememberMfa,
+        passwordless: config.passwordless,
         requestMfaCode,
         onMfaChallenge,
     };

package/build/auth/suny-sso.js

@@ -56,6 +56,7 @@ export class SunySSOFlow {
             baseUrl: `https://${SUNY_BRIGHTSPACE_HOST}`,
             headless: config.headless,
             rememberMfa: config.rememberMfa,
+            passwordless: config.passwordless,
             requestMfaCode: config.requestMfaCode,
             onMfaChallenge: config.onMfaChallenge,
         });

package/build/setup.js

@@ -359,11 +359,13 @@ export function buildConfigToSave(existing, answers) {
         username: answers.username,
         // Always the freshly typed one: a carried v1 plaintext password would
         // otherwise be the value written to the native store.
-        password: answers.password,
+        password: answers.passwordless ? undefined : answers.password,
         headless: answers.headless,
     };
     if (answers.rememberMfa !== undefined)
         config.rememberMfa = answers.rememberMfa;
+    if (answers.passwordless !== undefined)
+        config.passwordless = answers.passwordless;
     if (answers.campus)
         config.campus = answers.campus;
     return config;
@@ -488,20 +490,44 @@ async function main() {
     }
     console.log("");
     // ── Step 3: Password (hidden) ────────────────────────────────────
+    // Opt-in only, asked the way remember-MFA is: passwordless trades a saved
+    // password for a phone approval on every sign-in, so it is never the default.
+    let savedPasswordless;
+    try {
+        savedPasswordless = configStoreExists() ? loadConfigStore().passwordless : undefined;
+    }
+    catch {
+        // An invalid old config is replaced by the setup values below.
+    }
+    console.log(dim("  Microsoft Entra schools can sign you in with only a phone approval, so no password is saved on this computer."));
+    console.log(dim("  The cost: every sign-in, including automatic ones after a session expires, waits until you approve on your phone."));
+    console.log(dim("  Fine for using an assistant at your desk; not for unattended or scheduled use. It needs passwordless phone sign-in"));
+    console.log(dim("  turned on in Microsoft Authenticator first, or Microsoft will still ask for a password and sign-in will stop."));
+    const defaultPasswordless = savedPasswordless === true ? "yes" : "no";
+    let passwordlessAnswer = "";
+    while (!/^(y(es)?|no?)$/i.test(passwordlessAnswer)) {
+        passwordlessAnswer = await ask(rl, `  Sign in without a saved password (Microsoft Entra only)? (yes/no) [${defaultPasswordless}]: `) || defaultPasswordless;
+        if (!/^(y(es)?|no?)$/i.test(passwordlessAnswer))
+            console.log(yellow("  Please enter yes or no."));
+    }
+    const passwordless = /^y/i.test(passwordlessAnswer);
+    console.log("");
     // Close the rl temporarily since askPassword manages its own
     rl.close();
-    console.log(dim("  The password you use to sign in. It won't be shown as you type — asterisks stand in for each character."));
-    const passwordPrompt = preset
-        ? `What is your ${preset.name} password? `
-        : "What is your Brightspace password? ";
     let password = "";
-    while (!password) {
-        password = await askPassword(passwordPrompt);
-        if (!password) {
-            console.log(yellow("  Password is required."));
+    if (!passwordless) {
+        console.log(dim("  The password you use to sign in. It won't be shown as you type — asterisks stand in for each character."));
+        const passwordPrompt = preset
+            ? `What is your ${preset.name} password? `
+            : "What is your Brightspace password? ";
+        while (!password) {
+            password = await askPassword(passwordPrompt);
+            if (!password) {
+                console.log(yellow("  Password is required."));
+            }
         }
+        console.log("");
     }
-    console.log("");
     // Re-open readline for remaining prompts
     let rl2 = readline.createInterface({
         input: process.stdin,
@@ -566,10 +592,13 @@ async function main() {
         password,
         headless,
         rememberMfa,
+        passwordless,
         campus: campus || undefined,
     });
     await saveSecureConfig(config);
-    console.log(green("  Password saved in your operating system credential store."));
+    console.log(green(passwordless
+        ? "  No password saved: each sign-in will wait for your phone approval."
+        : "  Password saved in your operating system credential store."));
     console.log(green("  Config saved to: " + getConfigStorePath()));
     console.log("");
     // ── Step 6: Authenticate now? ────────────────────────────────────

package/build/tools/get-assignments.js

@@ -4,7 +4,7 @@
  * Licensed under MIT — see LICENSE file for details.
  */
 import { DEFAULT_CACHE_TTLS } from "../api/index.js";
-import { fetchAllItems } from "../api/paginate.js";
+import { fetchAllItems, fetchAllObjects } from "../api/paginate.js";
 import { GetAssignmentsSchema } from "./schemas.js";
 import { toolResponse, sanitizeError, isAuthUnavailable, authPendingNotice } from "./tool-helpers.js";
 import { convertHtmlToMarkdown } from "../utils/html-converter.js";
@@ -110,7 +110,10 @@ export async function fetchCourseAssignments(apiClient, courseId, baseUrl) {
     // cannot be made until they have answered.
     const [dropboxResult, quizResult, gradebookResult, contentResult] = await Promise.allSettled([
         apiClient.get(apiClient.le(courseId, "/dropbox/folders/"), { ttl: DEFAULT_CACHE_TTLS.assignments }),
-        apiClient.get(apiClient.le(courseId, "/quizzes/"), { ttl: DEFAULT_CACHE_TTLS.assignments }),
+        // Quizzes are paged; a course with many of them spills past page one.
+        fetchAllObjects(apiClient, apiClient.le(courseId, "/quizzes/"), {
+            ttl: DEFAULT_CACHE_TTLS.assignments,
+        }),
         apiClient.get(apiClient.le(courseId, "/grades/"), {
             ttl: DEFAULT_CACHE_TTLS.assignments,
         }),
@@ -263,11 +266,7 @@ export async function fetchCourseAssignments(apiClient, courseId, baseUrl) {
     // forbidden or unavailable, so a failed list starts from an empty set.
     let quizzes = [];
     if (quizResult.status === "fulfilled") {
-        const quizResponse = quizResult.value;
-        // D2L quizzes API returns paged result { Objects: [...] } or a plain array
-        quizzes = Array.isArray(quizResponse)
-            ? quizResponse
-            : quizResponse?.Objects ?? [];
+        quizzes = quizResult.value;
     }
     else {
         log("DEBUG", `Failed to fetch quizzes for course ${courseId}`, quizResult.reason);

package/build/tools/get-my-grades.js

@@ -4,7 +4,7 @@
  * Licensed under MIT — see LICENSE file for details.
  */
 import { DEFAULT_CACHE_TTLS } from "../api/index.js";
-import { fetchAllItems } from "../api/paginate.js";
+import { fetchAllItems, fetchAllObjects } from "../api/paginate.js";
 import { GetMyGradesSchema, } from "./schemas.js";
 import { toolResponse, sanitizeError, errorResponse, isAuthUnavailable, authPendingNotice, } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
@@ -27,8 +27,10 @@ const QUIZ_FEEDBACK_NOTE = "The gradebook has no comment for this item, but it i
  */
 async function fetchQuizzes(apiClient, courseId) {
     try {
-        const raw = await apiClient.get(apiClient.le(courseId, "/quizzes/"), { ttl: DEFAULT_CACHE_TTLS.assignments });
-        return Array.isArray(raw) ? raw : raw?.Objects ?? [];
+        // Quizzes are paged; a course with many of them spills past page one.
+        return await fetchAllObjects(apiClient, apiClient.le(courseId, "/quizzes/"), {
+            ttl: DEFAULT_CACHE_TTLS.assignments,
+        });
     }
     catch (error) {
         log("DEBUG", `get_my_grades: quiz list unavailable for course ${courseId}`, error);

package/build/tools/get-upcoming-due-dates.js

@@ -4,6 +4,7 @@
  * Licensed under MIT — see LICENSE file for details.
  */
 import { DEFAULT_CACHE_TTLS } from "../api/index.js";
+import { fetchAllObjects } from "../api/paginate.js";
 import { GetUpcomingDueDatesSchema, } from "./schemas.js";
 import { toolResponse, toolResponseWithNotice, sanitizeError, isAuthUnavailable, authPendingNotice } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
@@ -78,7 +79,10 @@ function calendarItems(events, items) {
 async function fetchCourseDueItems(apiClient, baseUrl, course, from, to) {
     const [dropboxResult, quizResult, discussionResult, calendarResult] = await Promise.allSettled([
         apiClient.get(apiClient.le(course.id, "/dropbox/folders/"), { ttl: DEFAULT_CACHE_TTLS.assignments }),
-        apiClient.get(apiClient.le(course.id, "/quizzes/"), { ttl: DEFAULT_CACHE_TTLS.assignments }),
+        // Quizzes are paged; a course with many of them spills past page one.
+        fetchAllObjects(apiClient, apiClient.le(course.id, "/quizzes/"), {
+            ttl: DEFAULT_CACHE_TTLS.assignments,
+        }),
         fetchDiscussionDueTopics(apiClient, course.id),
         fetchCourseCalendarEvents(apiClient, baseUrl, course, from, to),
     ]);
@@ -117,7 +121,7 @@ async function fetchCourseDueItems(apiClient, baseUrl, course, from, to) {
         log("DEBUG", `get_upcoming_due_dates: failed to fetch dropbox folders for course ${course.id}`, dropboxResult.reason);
     }
     if (quizResult.status === "fulfilled") {
-        for (const quiz of unwrapList(quizResult.value)) {
+        for (const quiz of quizResult.value) {
             if (quiz.IsActive === false)
                 continue;
             // Many instructors set only an End Date, which is the effective deadline.

package/build/utils/config.js

@@ -53,6 +53,12 @@ export async function loadConfig() {
     const rememberMfa = envBoolean(process.env.D2L_REMEMBER_MFA, "D2L_REMEMBER_MFA")
         ?? store?.rememberMfa
         ?? false;
+    // Opt-in: sign in with Microsoft's passwordless phone approval, so no
+    // password is read or saved. Every sign-in then needs the phone, which is
+    // why it is off unless the user chose it in setup or set D2L_PASSWORDLESS.
+    const passwordless = envBoolean(process.env.D2L_PASSWORDLESS, "D2L_PASSWORDLESS")
+        ?? store?.passwordless
+        ?? false;
     // Resolve tokenTtl: env > store > default (3600)
     const tokenTtl = positiveSeconds(process.env.D2L_TOKEN_TTL, "D2L_TOKEN_TTL")
         ?? positiveSeconds(store?.tokenTtl, "tokenTtl in config.json")
@@ -87,7 +93,7 @@ export async function loadConfig() {
     }
     const baseUrl = configuredUrl.origin;
     const username = process.env.D2L_USERNAME || store?.username;
-    const password = await resolveStoredPassword(baseUrl, username, store);
+    const password = passwordless ? undefined : await resolveStoredPassword(baseUrl, username, store);
     // A new account must never inherit another account's cookies, even at the same school.
     const sessionDir = accountSessionDirectory(sessionRoot, baseUrl, username);
     const legacyMigration = sessionDir !== sessionRoot ? await migrateLegacyState(sessionRoot) : undefined;
@@ -99,6 +105,7 @@ export async function loadConfig() {
         tokenTtl,
         headless,
         rememberMfa,
+        passwordless,
         username,
         password,
         campus: process.env.D2L_CAMPUS || store?.campus,

package/build/utils/secure-config.js

@@ -1,4 +1,4 @@
-import { getStoredPassword, setStoredPassword } from "../auth/credential-store.js";
+import { deleteStoredPassword, getStoredPassword, setStoredPassword } from "../auth/credential-store.js";
 import * as path from "node:path";
 import { acquireProcessLock } from "../auth/auth-lock.js";
 import { configStoreExists, getConfigStorePath, loadConfigStore, saveConfigStore } from "./config-store.js";
@@ -33,6 +33,9 @@ async function saveSecureConfigUnlocked(config) {
             throw new Error("Could not verify the password in the native credential store. Configuration was preserved.");
         }
     }
+    if (publicConfig.passwordless && config.baseUrl && config.username) {
+        await deleteStoredPassword(config.baseUrl, config.username);
+    }
     saveConfigStore(publicConfig);
 }
 /** Migrate a v1 password under its own account, before resolving environment overrides. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.11.15",
+  "version": "3.12.1",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",