@linzumi/cli 1.0.95 → 1.0.97

package/scripts/build-auth-parity-oracle.mjs

@@ -0,0 +1,708 @@
+// Spec: kandan/plans/2026-07-10-compute-nodes-rescript-commander-zero-ts-program.md
+// (M3 cluster 3, auth).
+// Relationship: Builds the TS-side PARITY ORACLE for the auth cluster of
+// the ReScript commander port, the sibling of
+// build-protocol-parity-oracle.mjs (cluster 1) and
+// build-config-identity-parity-oracle.mjs (cluster 2). The oracle bundles
+// the REAL TS auth modules (oauth.ts, deviceAuthWait.ts, authResolution.ts,
+// runnerTokenExpiry.ts, runnerTokenRenewer.ts, channelSessionSupport.ts's
+// access-token claim slice, authCache.ts, mcpServer.ts's
+// resolveMcpLocalRunnerToken, runner.ts's writeEphemeralMcpAuthFile, and
+// signupServerClient.ts + signupFlow.ts's signup-auth transforms) behind
+// the same one-shot stdin/stdout batch driver: a JSON array of cases in, a
+// JSON array of results out.
+//
+// FLOW cases carry a `baseUrl`/`kandanUrl` pointing at the ReScript parity
+// suite's scripted auth HTTP server (ScriptedAuthServer.res), so the REAL
+// TS flow functions run their real fetch legs against the same scripted
+// wire the ReScript port runs against - outcome equivalence is asserted on
+// both sides by AuthParityConformance.res.
+//
+// Determinism: every clock is injected per case (pollDeviceCodeForToken's
+// `now` dep, the device wait's deps.now, the renewer's deps.now/setTimer)
+// or scoped through the fixed-Date override for the modules whose
+// timestamps are not injectable (authCache's issuedAt, signupFlow's
+// createdAt). Scratch paths normalize through the "$DIR" placeholder.
+//
+// SECRETS: the oracle only ever sees the conformance suite's synthetic
+// tokens; nothing here logs case payloads.
+import { copyFile, mkdir } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { build } from 'esbuild';
+
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+
+const driverSource = `
+import { mkdtempSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import {
+  deviceAuthFailureMessage,
+  kandanHttpBaseUrl,
+  pollDeviceCodeForToken,
+  renewLocalRunnerToken,
+  startDeviceAuthorization,
+  validateLocalRunnerTokenOutcome,
+} from './src/oauth';
+import {
+  deviceWaitPromptDecision,
+  renderDeviceWaitEvent,
+  waitForDeviceAuthorization,
+} from './src/deviceAuthWait';
+import {
+  resolveLocalRunnerToken,
+  unusableCachedTokenNotice,
+} from './src/authResolution';
+import { resolveRunnerTokenExpiresAt } from './src/runnerTokenExpiry';
+import { createRunnerTokenRenewer } from './src/runnerTokenRenewer';
+import {
+  accessTokenExpiresAtIso,
+  identityFromAccessToken,
+  singleWorkspaceScopeFromAccessToken,
+} from './src/channelSessionSupport';
+import {
+  readCachedLocalRunnerToken,
+  writeCachedLocalRunnerToken,
+} from './src/authCache';
+import { resolveMcpLocalRunnerToken } from './src/mcpServer';
+import { writeEphemeralMcpAuthFile } from './src/runner';
+import { createSignupServerClient } from './src/signupServerClient';
+import {
+  comparableServiceUrl,
+  signupAuthFromVerification,
+  signupAuthMatchesServiceUrl,
+} from './src/signupFlow';
+
+// --- Shared plumbing (the cluster 2 conventions) -----------------------------------
+
+const dirPlaceholder = '$DIR';
+
+function scratch() {
+  return realpathSync(mkdtempSync(join(tmpdir(), 'linzumi-auth-oracle-')));
+}
+
+function substitute(value, from, to) {
+  if (typeof value === 'string') {
+    return value.split(from).join(to);
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => substitute(entry, from, to));
+  }
+  if (typeof value === 'object' && value !== null) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [
+        substitute(key, from, to),
+        substitute(entry, from, to),
+      ])
+    );
+  }
+  return value;
+}
+
+function outcome(run) {
+  try {
+    const value = run();
+    return value === undefined ? { defined: false } : { defined: true, value };
+  } catch (error) {
+    return errorOutcome(error);
+  }
+}
+
+async function outcomeAsync(run) {
+  try {
+    const value = await run();
+    return value === undefined ? { defined: false } : { defined: true, value };
+  } catch (error) {
+    return errorOutcome(error);
+  }
+}
+
+function errorOutcome(error) {
+  const shaped = {
+    threw: true,
+    message: error instanceof Error ? error.message : String(error),
+  };
+  if (error instanceof Error && error.name === 'SignupServerError') {
+    shaped.name = error.name;
+    shaped.status = error.status;
+    shaped.code = error.code;
+  }
+  return shaped;
+}
+
+const RealDate = Date;
+
+function withFixedNow(nowMs, run) {
+  if (nowMs === undefined) {
+    return run();
+  }
+  class FixedDate extends RealDate {
+    constructor(...args) {
+      if (args.length === 0) {
+        super(nowMs);
+      } else {
+        super(...args);
+      }
+    }
+    static now() {
+      return nowMs;
+    }
+  }
+  globalThis.Date = FixedDate;
+  try {
+    return run();
+  } finally {
+    globalThis.Date = RealDate;
+  }
+}
+
+// A deterministic clock: starts at startMs and advances by stepMs per
+// read, matching AuthParityConformance's steppedNow.
+function steppedNow(startMs, stepMs) {
+  let reads = 0;
+  return () => {
+    const value = startMs + reads * stepMs;
+    reads += 1;
+    return value;
+  };
+}
+
+function fileMode(path) {
+  return statSync(path).mode & 0o777;
+}
+
+// --- Pure transforms -----------------------------------------------------------------
+
+function handleAccessTokenClaims(testCase) {
+  return {
+    identity: outcome(() => identityFromAccessToken(testCase.token)),
+    workspaceScope: outcome(() => singleWorkspaceScopeFromAccessToken(testCase.token)),
+    expiresAtIso: outcome(() => accessTokenExpiresAtIso(testCase.token)),
+  };
+}
+
+function handleDeviceAuthFailureMessage(testCase) {
+  return outcome(() =>
+    deviceAuthFailureMessage(testCase.error ?? undefined, testCase.httpStatus ?? undefined)
+  );
+}
+
+function handleDeviceWaitPromptDecision(testCase) {
+  return outcome(() =>
+    deviceWaitPromptDecision({
+      cycle: testCase.cycle,
+      nowMs: testCase.nowMs,
+      lastLoudPromptAtMs: testCase.lastLoudPromptAtMs ?? undefined,
+      isInteractive: testCase.isInteractive,
+    })
+  );
+}
+
+function handleRenderDeviceWaitEvent(testCase) {
+  return outcome(() => renderDeviceWaitEvent(testCase.event));
+}
+
+function handleUnusableCachedTokenNotice(testCase) {
+  return outcome(() => unusableCachedTokenNotice(testCase.outcome));
+}
+
+function handleKandanHttpBaseUrl(testCase) {
+  return outcome(() => kandanHttpBaseUrl(testCase.kandanUrl));
+}
+
+function handleComparableServiceUrl(testCase) {
+  return outcome(() => comparableServiceUrl(testCase.value));
+}
+
+function handleSignupAuthMatch(testCase) {
+  return outcome(() => signupAuthMatchesServiceUrl(testCase.auth, testCase.serviceUrl));
+}
+
+function handleSignupAuthFromVerification(testCase) {
+  return withFixedNow(testCase.nowMs, () =>
+    outcome(() => signupAuthFromVerification(testCase.verifiedAuth, testCase.serviceUrl))
+  );
+}
+
+// --- Token expiry resolution -----------------------------------------------------------
+
+function handleRunnerTokenExpiry(testCase) {
+  const dir = scratch();
+  const authFilePath = join(dir, 'auth.json');
+  if (testCase.authFileContents !== undefined) {
+    writeFileSync(authFilePath, testCase.authFileContents, 'utf8');
+  }
+  const result = withFixedNow(testCase.nowMs, () =>
+    outcome(() =>
+      resolveRunnerTokenExpiresAt({
+        kandanUrl: testCase.kandanUrl,
+        token: testCase.token,
+        explicitToken: testCase.explicitToken ?? undefined,
+        authFilePath,
+      })
+    )
+  );
+  return substitute(result, dir, dirPlaceholder);
+}
+
+// --- Token renewer (scripted renewal sequence, recorded timers) -------------------------
+
+async function handleTokenRenewer(testCase) {
+  const script = [...(testCase.script ?? [])];
+  const timers = [];
+  const logs = [];
+  const persisted = [];
+  const now = steppedNow(testCase.nowStartMs, testCase.nowStepMs);
+  const renewer = createRunnerTokenRenewer({
+    initialToken: testCase.initialToken,
+    tokenExpiresAt: testCase.tokenExpiresAt ?? undefined,
+    deps: {
+      renew: async () => {
+        const step = script.shift();
+        if (step === undefined) {
+          throw new Error('renewal script exhausted');
+        }
+        if (step.result === 'reject') {
+          throw new Error(step.message);
+        }
+        if (step.result === 'renewed') {
+          return {
+            kind: 'renewed',
+            accessToken: step.accessToken,
+            expiresInSeconds: step.expiresInSeconds ?? undefined,
+          };
+        }
+        return { kind: step.result };
+      },
+      persist:
+        testCase.persistFails === true
+          ? () => {
+              throw new Error(testCase.persistFailureMessage);
+            }
+          : (args) => {
+              persisted.push({
+                accessToken: args.accessToken,
+                expiresInSeconds: args.expiresInSeconds ?? null,
+              });
+            },
+      log: (event, payload) => {
+        logs.push({ event, payload });
+      },
+      now,
+      // Timers are RECORDED, never fired: the parity fixture drives
+      // renewNow() explicitly so both impls observe the same schedule.
+      setTimer: (_callback, delayMs) => {
+        timers.push(delayMs);
+        return timers.length;
+      },
+      clearTimer: () => {},
+    },
+  });
+  renewer.start();
+  const results = [];
+  const renewCalls = testCase.renewCalls ?? (testCase.script ?? []).length;
+  for (let call = 0; call < renewCalls; call += 1) {
+    results.push(await outcomeAsync(() => renewer.renewNow()));
+  }
+  const overlap = [];
+  if (testCase.probeOverlap === true) {
+    // Fire two renewNow calls into the same in-flight renewal: the second
+    // must observe in_progress.
+    const first = renewer.renewNow();
+    const second = await renewer.renewNow();
+    overlap.push(await outcomeAsync(() => first), { defined: true, value: second });
+  }
+  renewer.stop();
+  return {
+    results,
+    overlap,
+    currentToken: renewer.currentToken(),
+    timers,
+    logs,
+    persisted,
+  };
+}
+
+// --- HTTP flow legs (against the scripted auth server) ----------------------------------
+
+async function handleValidate(testCase) {
+  return outcomeAsync(() =>
+    validateLocalRunnerTokenOutcome({
+      kandanUrl: testCase.kandanUrl,
+      accessToken: testCase.accessToken,
+      workspaceSlug: testCase.workspaceSlug ?? undefined,
+      channelSlug: testCase.channelSlug ?? undefined,
+      requiredScopes: testCase.requiredScopes ?? undefined,
+    })
+  );
+}
+
+async function handleRenew(testCase) {
+  return outcomeAsync(() =>
+    renewLocalRunnerToken({
+      kandanUrl: testCase.kandanUrl,
+      accessToken: testCase.accessToken,
+    })
+  );
+}
+
+async function handleDeviceStart(testCase) {
+  return outcomeAsync(() =>
+    startDeviceAuthorization({
+      httpBaseUrl: testCase.httpBaseUrl,
+      workspaceSlug: testCase.workspaceSlug ?? undefined,
+      channelSlug: testCase.channelSlug ?? undefined,
+      onboarding: testCase.onboarding ?? undefined,
+      identity: testCase.identity ?? undefined,
+    })
+  );
+}
+
+async function handleDevicePoll(testCase) {
+  return outcomeAsync(() =>
+    pollDeviceCodeForToken({
+      httpBaseUrl: testCase.httpBaseUrl,
+      deviceCode: testCase.deviceCode,
+      expiresInSeconds: testCase.expiresInSeconds ?? undefined,
+      now:
+        testCase.nowStartMs === undefined
+          ? undefined
+          : steppedNow(testCase.nowStartMs, testCase.nowStepMs),
+    })
+  );
+}
+
+async function handleDeviceWaitFlow(testCase) {
+  const events = [];
+  const logs = [];
+  const sleeps = [];
+  const result = await outcomeAsync(() =>
+    waitForDeviceAuthorization({
+      kandanUrl: testCase.kandanUrl,
+      workspaceSlug: testCase.workspaceSlug ?? undefined,
+      channelSlug: testCase.channelSlug ?? undefined,
+      onboarding: testCase.onboarding ?? undefined,
+      identity: testCase.identity ?? undefined,
+      isInteractive: testCase.isInteractive,
+      deps: {
+        now: steppedNow(testCase.nowStartMs, testCase.nowStepMs),
+        sleep: async (ms) => {
+          sleeps.push(ms);
+        },
+        report: (event) => {
+          events.push(event);
+        },
+        log: (event, payload) => {
+          logs.push({ event, payload });
+        },
+      },
+    })
+  );
+  return { result, events, logs, sleeps };
+}
+
+// The device acquisition composition resolveTokenFlow injects: the REAL
+// persistent wait + the REAL cache write, minus the machine-identity read
+// (which would touch the real ~/.linzumi; identity parity is pinned by the
+// cluster 2 fingerprint cases).
+function deviceAcquire(testCase, authFilePath, waitEvents) {
+  return async (args) => {
+    const token = await waitForDeviceAuthorization({
+      kandanUrl: args.kandanUrl,
+      workspaceSlug: args.workspaceSlug,
+      channelSlug: args.channelSlug,
+      onboarding: args.onboarding,
+      isInteractive: false,
+      deps: {
+        now: steppedNow(testCase.nowStartMs, testCase.nowStepMs),
+        sleep: async () => {},
+        report: (event) => {
+          waitEvents.push(event);
+        },
+        log: () => {},
+      },
+    });
+    withFixedNow(testCase.nowMs, () =>
+      writeCachedLocalRunnerToken({
+        kandanUrl: args.kandanUrl,
+        accessToken: token.accessToken,
+        expiresInSeconds: token.expiresInSeconds,
+        authFilePath,
+      })
+    );
+    return token.accessToken;
+  };
+}
+
+async function handleResolveTokenFlow(testCase) {
+  const dir = scratch();
+  const authFilePath = join(dir, 'auth.json');
+  if (testCase.authFileContents !== undefined) {
+    writeFileSync(authFilePath, testCase.authFileContents, 'utf8');
+  }
+  const reported = [];
+  const waitEvents = [];
+  const result = await outcomeAsync(() =>
+    resolveLocalRunnerToken(
+      {
+        kandanUrl: testCase.kandanUrl,
+        explicitToken: testCase.explicitToken ?? undefined,
+        workspaceSlug: testCase.workspaceSlug ?? undefined,
+        channelSlug: testCase.channelSlug ?? undefined,
+        requiredScopes: testCase.requiredScopes ?? undefined,
+        authFilePath,
+        reportRejectedCachedToken: (outcomeName) => {
+          reported.push(outcomeName);
+        },
+      },
+      {
+        readCachedToken: (kandanUrl, path) =>
+          withFixedNow(testCase.nowMs, () => readCachedLocalRunnerToken(kandanUrl, path)),
+        validateToken: validateLocalRunnerTokenOutcome,
+        acquireAndCacheToken: deviceAcquire(testCase, authFilePath, waitEvents),
+      }
+    )
+  );
+  let authFileBytes = null;
+  try {
+    authFileBytes = readFileSync(authFilePath, 'utf8');
+  } catch {
+    authFileBytes = null;
+  }
+  return substitute({ result, reported, waitEvents, authFileBytes }, dir, dirPlaceholder);
+}
+
+async function handleResolveMcpTokenFlow(testCase) {
+  const dir = scratch();
+  const authFilePath = join(dir, 'auth.json');
+  if (testCase.authFileContents !== undefined) {
+    writeFileSync(authFilePath, testCase.authFileContents, 'utf8');
+  }
+  const waitEvents = [];
+  const result = await outcomeAsync(() =>
+    resolveMcpLocalRunnerToken(
+      {
+        kandanUrl: testCase.kandanUrl,
+        explicitToken: testCase.explicitToken ?? undefined,
+        authFilePath,
+        workspaceSlug: testCase.workspaceSlug ?? undefined,
+        channelSlug: testCase.channelSlug ?? undefined,
+      },
+      {
+        readCachedToken: (kandanUrl, path) =>
+          withFixedNow(testCase.nowMs, () => readCachedLocalRunnerToken(kandanUrl, path)),
+        validateTokenOutcome: validateLocalRunnerTokenOutcome,
+        resolveToken: (args) =>
+          resolveLocalRunnerToken(args, {
+            readCachedToken: (kandanUrl, path) =>
+              withFixedNow(testCase.nowMs, () => readCachedLocalRunnerToken(kandanUrl, path)),
+            validateToken: validateLocalRunnerTokenOutcome,
+            acquireAndCacheToken: deviceAcquire(testCase, authFilePath, waitEvents),
+          }),
+      }
+    )
+  );
+  let authFileBytes = null;
+  try {
+    authFileBytes = readFileSync(authFilePath, 'utf8');
+  } catch {
+    authFileBytes = null;
+  }
+  return substitute({ result, waitEvents, authFileBytes }, dir, dirPlaceholder);
+}
+
+// --- MCP ephemeral auth file (cross-impl legs) -------------------------------------------
+
+function handleMintMcpAuthFile(testCase) {
+  const minted = withFixedNow(testCase.nowMs, () =>
+    outcome(() =>
+      writeEphemeralMcpAuthFile({
+        kandanUrl: testCase.kandanUrl,
+        token: testCase.token,
+        linzumiAgentMcpToken: testCase.linzumiAgentMcpToken ?? undefined,
+      })
+    )
+  );
+  if (minted.threw === true) {
+    return { minted };
+  }
+  const { path, cleanup } = minted.value;
+  const directory = join(path, '..');
+  const shaped = {
+    fileBytes: readFileSync(path, 'utf8'),
+    dirMode: fileMode(directory),
+    fileMode: fileMode(path),
+    readBack: withFixedNow(testCase.nowMs, () =>
+      outcome(() => readCachedLocalRunnerToken(testCase.kandanUrl, path))
+    ),
+  };
+  if (testCase.keep === true) {
+    // The ReScript suite consumes this real path cross-impl, then removes it.
+    shaped.keptPath = path;
+  } else {
+    cleanup();
+  }
+  return { minted: { defined: true, value: 'minted' }, ...shaped };
+}
+
+function handleReadCachedTokenAtPath(testCase) {
+  return withFixedNow(testCase.nowMs, () =>
+    outcome(() => readCachedLocalRunnerToken(testCase.kandanUrl, testCase.authFilePath))
+  );
+}
+
+function handleWriteCachedTokenAtPath(testCase) {
+  return withFixedNow(testCase.nowMs, () =>
+    outcome(() =>
+      writeCachedLocalRunnerToken({
+        kandanUrl: testCase.kandanUrl,
+        accessToken: testCase.accessToken,
+        expiresInSeconds: testCase.expiresInSeconds ?? undefined,
+        authFilePath: testCase.authFilePath,
+      })
+    )
+  );
+}
+
+function handleRemovePath(testCase) {
+  return outcome(() => {
+    rmSync(testCase.path, { recursive: true, force: true });
+  });
+}
+
+// --- Signup client (live against the scripted server) --------------------------------------
+
+async function handleSignupClientLive(testCase) {
+  const client = createSignupServerClient({ serviceUrl: testCase.serviceUrl });
+  switch (testCase.leg) {
+    case 'startEmailCode':
+      return outcomeAsync(() =>
+        client.startEmailCode({
+          email: testCase.email,
+          mode: testCase.mode,
+          selectedTasks: testCase.selectedTasks ?? undefined,
+        })
+      );
+    case 'verifyEmailCode':
+      return outcomeAsync(() =>
+        client.verifyEmailCode({ pendingId: testCase.pendingId, code: testCase.code })
+      );
+    case 'validateAuth':
+      return outcomeAsync(() => client.validateAuth({ accessToken: testCase.accessToken }));
+    default:
+      return { threw: true, message: 'unknown signup leg ' + String(testCase.leg) };
+  }
+}
+
+// --- Dispatch --------------------------------------------------------------------------------
+
+async function handle(testCase) {
+  switch (testCase.op) {
+    case 'accessTokenClaims':
+      return handleAccessTokenClaims(testCase);
+    case 'deviceAuthFailureMessage':
+      return handleDeviceAuthFailureMessage(testCase);
+    case 'deviceWaitPromptDecision':
+      return handleDeviceWaitPromptDecision(testCase);
+    case 'renderDeviceWaitEvent':
+      return handleRenderDeviceWaitEvent(testCase);
+    case 'unusableCachedTokenNotice':
+      return handleUnusableCachedTokenNotice(testCase);
+    case 'kandanHttpBaseUrl':
+      return handleKandanHttpBaseUrl(testCase);
+    case 'comparableServiceUrl':
+      return handleComparableServiceUrl(testCase);
+    case 'signupAuthMatch':
+      return handleSignupAuthMatch(testCase);
+    case 'signupAuthFromVerification':
+      return handleSignupAuthFromVerification(testCase);
+    case 'runnerTokenExpiry':
+      return handleRunnerTokenExpiry(testCase);
+    case 'tokenRenewer':
+      return handleTokenRenewer(testCase);
+    case 'validate':
+      return handleValidate(testCase);
+    case 'renew':
+      return handleRenew(testCase);
+    case 'deviceStart':
+      return handleDeviceStart(testCase);
+    case 'devicePoll':
+      return handleDevicePoll(testCase);
+    case 'deviceWaitFlow':
+      return handleDeviceWaitFlow(testCase);
+    case 'resolveTokenFlow':
+      return handleResolveTokenFlow(testCase);
+    case 'resolveMcpTokenFlow':
+      return handleResolveMcpTokenFlow(testCase);
+    case 'mintMcpAuthFile':
+      return handleMintMcpAuthFile(testCase);
+    case 'readCachedTokenAtPath':
+      return handleReadCachedTokenAtPath(testCase);
+    case 'writeCachedTokenAtPath':
+      return handleWriteCachedTokenAtPath(testCase);
+    case 'removePath':
+      return handleRemovePath(testCase);
+    case 'signupClientLive':
+      return handleSignupClientLive(testCase);
+    default:
+      return { threw: true, message: 'unknown op ' + String(testCase.op) };
+  }
+}
+
+let stdin = '';
+process.stdin.setEncoding('utf8');
+for await (const chunk of process.stdin) {
+  stdin += chunk;
+}
+const cases = JSON.parse(stdin);
+const results = [];
+// Sequential on purpose: the fixed-Date override and the scripted server's
+// per-route response queues both assume one case at a time.
+for (const testCase of cases) {
+  results.push(await handle(testCase));
+}
+process.stdout.write(JSON.stringify(results));
+`;
+
+await mkdir(join(packageRoot, '.differential'), { recursive: true });
+
+// runner.ts's graph resolves assets/ relative to the bundle at import time
+// (same requirement as build-differential-entry.mjs).
+await mkdir(join(packageRoot, '.differential/assets'), { recursive: true });
+await copyFile(
+  join(packageRoot, 'src/assets/linzumi-logo.svg'),
+  join(packageRoot, '.differential/assets/linzumi-logo.svg')
+);
+
+// Renamed banner import (the build-differential-entry.mjs convention):
+// this bundle keeps source-level identifiers and the commander sources
+// import createRequire themselves - a bare banner name would collide. The
+// banner is needed at all because CJS transitive deps (@inquirer's
+// yoctocolors) require() node builtins at module scope.
+const banner = {
+  js: "import { createRequire as __authOracleCreateRequire } from 'node:module';\nconst require = __authOracleCreateRequire(import.meta.url);",
+};
+
+await build({
+  stdin: {
+    contents: driverSource,
+    resolveDir: packageRoot,
+    sourcefile: 'auth-parity-driver.ts',
+    loader: 'ts',
+  },
+  banner,
+  bundle: true,
+  platform: 'node',
+  target: 'node20',
+  format: 'esm',
+  outfile: join(packageRoot, '.differential/auth-parity-oracle.mjs'),
+  minify: false,
+  sourcemap: false,
+  legalComments: 'none',
+  // runner.ts/mcpServer.ts/signupFlow.ts pull the wider commander graph;
+  // the same runtime externals as the differential entry build stay
+  // external (installed in this package's node_modules; the oracle only
+  // exercises the auth exports).
+  external: ['ws', 'undici', 'blessed', '@anthropic-ai/claude-agent-sdk'],
+});