@forgezero/agent 0.1.103 → 0.1.108

package/dist/fz.js

@@ -4634,7 +4634,7 @@ var VaultError, runtimeEnvironment = () => typeof process !== "undefined" && pro
   } catch {
     return;
   }
-}, VERSION = "0.1.19";
+}, VERSION = "0.1.20";
 var init_dist = __esm(() => {
   init_identity();
   VaultError = class VaultError extends Error {
@@ -4810,9 +4810,9 @@ async function spawnWith(command, env, report = () => {}, options = {}) {
 }
 
 // src/cli/index.ts
-import { existsSync as existsSync13, lstatSync as lstatSync10, mkdirSync as mkdirSync13, readFileSync as readFileSync16, renameSync as renameSync10, rmSync as rmSync8, writeFileSync as writeFileSync13 } from "fs";
+import { existsSync as existsSync13, lstatSync as lstatSync11, mkdirSync as mkdirSync13, readFileSync as readFileSync17, renameSync as renameSync10, rmSync as rmSync8, writeFileSync as writeFileSync13 } from "fs";
 import { randomBytes as randomBytes10 } from "crypto";
-import { basename as basename3, dirname as dirname14, isAbsolute as isAbsolute7, join as join13, resolve as resolve12 } from "path";
+import { basename as basename3, dirname as dirname14, isAbsolute as isAbsolute7, join as join13, resolve as resolve13 } from "path";
 
 // src/process-input.ts
 async function writeAndCloseProcessInput(input, value) {
@@ -4841,7 +4841,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.103";
+var VERSION2 = "0.1.108";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -12058,7 +12058,7 @@ function removeSession(api, realm, path = defaultSessionPath()) {
 }
 
 // src/bootstrap.ts
-import { createHash as createHash4, createHmac as createHmac2, createPrivateKey, randomBytes as randomBytes7 } from "crypto";
+import { createHash as createHash4, createHmac as createHmac2, randomBytes as randomBytes7 } from "crypto";
 import {
   chmodSync as chmodSync4,
   existsSync as existsSync9,
@@ -12337,10 +12337,8 @@ function validatePlatformSharedEnvironment(input) {
   } else if (input.email !== undefined) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
-  if (input.githubApp) {
-    if (!/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubApp.clientId) || !/^[1-9][0-9]{0,19}$/.test(input.githubApp.appId) || !/^[a-z0-9][a-z0-9-]{0,99}$/.test(input.githubApp.slug)) {
-      throw new Error("GitHub App client id, app id or slug is malformed.");
-    }
+  if (!input.githubOAuth || !/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubOAuth.clientId)) {
+    throw new Error("GitHub OAuth client id is malformed.");
   }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
   if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
@@ -12472,9 +12470,7 @@ function renderPlatformSharedEnvironment(input) {
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
     FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
-    FZ_GITHUB_CLIENT_ID: value.githubApp?.clientId ?? "",
-    FZ_GITHUB_APP_ID: value.githubApp?.appId ?? "",
-    FZ_GITHUB_APP_SLUG: value.githubApp?.slug ?? "",
+    FZ_GITHUB_OAUTH_CLIENT_ID: value.githubOAuth.clientId,
     FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
@@ -12486,9 +12482,7 @@ function platformApiCredentialSpecs(options) {
   const optional = [
     ["fz_smtp.password", options.emailProvider === "smtp"],
     ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
-    ["fz_github.clientSecret", options.githubApp],
-    ["fz_github.privateKey", options.githubApp],
-    ["fz_github.webhookSecret", options.githubApp],
+    ["fz_oauth.github.clientSecret", options.githubOAuth],
     ["CF_API_TOKEN", options.cloudflareKv],
     ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],
@@ -12496,6 +12490,7 @@ function platformApiCredentialSpecs(options) {
   ];
   return [
     { name: "arangodb-jwt", encryptedPath: "/etc/forgezero/creds/arangodb-jwt.cred", required: true },
+    { name: "arangodb-root-password", encryptedPath: "/etc/forgezero/creds/arangodb-root-password.cred", required: true },
     { name: "seed-sync-root", encryptedPath: "/etc/forgezero/creds/seed-sync-root.cred", required: true },
     ...optional.filter(([, present]) => present).map(([name]) => ({
       name,
@@ -14079,6 +14074,46 @@ async function buildBootstrapBundle(input, exec = run) {
     throw cause;
   }
 }
+async function refreshBootstrapBundle(input, exec = run) {
+  const outputPath = resolve6(input.outputPath);
+  const manifestPath = `${outputPath}.json`;
+  if (existsSync8(outputPath) !== existsSync8(manifestPath)) {
+    throw new Error("bootstrap bundle and manifest must either both exist or both be absent");
+  }
+  const candidatePath = `${outputPath}.candidate.${process.pid}.${randomBytes6(6).toString("hex")}`;
+  const candidate = await buildBootstrapBundle({ ...input, outputPath: candidatePath }, exec);
+  try {
+    if (!existsSync8(outputPath)) {
+      renameSync7(candidate.bundlePath, outputPath);
+      renameSync7(candidate.manifestPath, manifestPath);
+      return readBootstrapBundle(outputPath);
+    }
+    const current2 = await readBootstrapBundle(outputPath);
+    if (current2.manifest.branch === candidate.manifest.branch && current2.manifest.revision === candidate.manifest.revision) {
+      rmSync5(candidate.bundlePath, { force: true });
+      rmSync5(candidate.manifestPath, { force: true });
+      return current2;
+    }
+    const archivePath = `${outputPath}.before-${current2.manifest.revision.slice(0, 7)}-${Date.now()}`;
+    const archiveManifestPath = `${archivePath}.json`;
+    renameSync7(outputPath, archivePath);
+    renameSync7(manifestPath, archiveManifestPath);
+    try {
+      renameSync7(candidate.bundlePath, outputPath);
+      renameSync7(candidate.manifestPath, manifestPath);
+      return readBootstrapBundle(outputPath);
+    } catch (cause) {
+      rmSync5(outputPath, { force: true });
+      rmSync5(manifestPath, { force: true });
+      renameSync7(archivePath, outputPath);
+      renameSync7(archiveManifestPath, manifestPath);
+      throw cause;
+    }
+  } finally {
+    rmSync5(candidate.bundlePath, { force: true });
+    rmSync5(candidate.manifestPath, { force: true });
+  }
+}
 
 // src/bootstrap.ts
 var PLATFORM_BOOTSTRAP_PROFILES = [
@@ -14127,9 +14162,7 @@ function validatePlatformBootstrapSecrets(config, input) {
     "backupS3Secret",
     "cloudflareTunnelToken",
     "cloudflareApiToken",
-    "githubClientSecret",
-    "githubPrivateKeyBase64",
-    "githubWebhookSecret"
+    "githubOAuthClientSecret"
   ];
   const unknown = Object.keys(source).filter((key) => !allowed.includes(key));
   if (unknown.length)
@@ -14140,9 +14173,7 @@ function validatePlatformBootstrapSecrets(config, input) {
   const backupS3Secret = typeof source.backupS3Secret === "string" ? source.backupS3Secret.trim() : undefined;
   const cloudflareTunnelToken = typeof source.cloudflareTunnelToken === "string" ? source.cloudflareTunnelToken.trim() : undefined;
   const cloudflareApiToken = typeof source.cloudflareApiToken === "string" ? source.cloudflareApiToken.trim() : undefined;
-  const githubClientSecret = typeof source.githubClientSecret === "string" ? source.githubClientSecret.trim() : undefined;
-  const githubPrivateKeyBase64 = typeof source.githubPrivateKeyBase64 === "string" ? source.githubPrivateKeyBase64.trim() : undefined;
-  const githubWebhookSecret = typeof source.githubWebhookSecret === "string" ? source.githubWebhookSecret.trim() : undefined;
+  const githubOAuthClientSecret = typeof source.githubOAuthClientSecret === "string" ? source.githubOAuthClientSecret.trim() : "";
   if (!/^[a-f0-9]{64}$/i.test(clusterBootstrapCode))
     throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
   if (!emailSecret || emailSecret.length > 16384 || /[\r\n\0]/.test(emailSecret))
@@ -14162,21 +14193,8 @@ function validatePlatformBootstrapSecrets(config, input) {
   }
   if (cloudflareTunnelToken)
     validateCloudflareBootstrapSecretPair({ cloudflareTunnelToken, cloudflareApiToken });
-  const githubConfigured = Boolean(config.runtime.environment.githubApp);
-  if (githubConfigured !== Boolean(githubClientSecret && githubPrivateKeyBase64 && githubWebhookSecret)) {
-    throw new Error("GitHub App coordinates require client secret, private key and webhook secret together");
-  }
-  if (githubConfigured) {
-    if (githubClientSecret.length < 20 || githubClientSecret.length > 512 || /[\r\n\0]/.test(githubClientSecret) || githubWebhookSecret.length < 32 || githubWebhookSecret.length > 512 || /[\r\n\0]/.test(githubWebhookSecret)) {
-      throw new Error("GitHub App client or webhook secret is malformed");
-    }
-    try {
-      const pem = Buffer.from(githubPrivateKeyBase64, "base64").toString("utf8");
-      if (createPrivateKey(pem).asymmetricKeyType !== "rsa")
-        throw new Error("not RSA");
-    } catch {
-      throw new Error("GitHub App private key must be a base64-encoded RSA private key");
-    }
+  if (githubOAuthClientSecret.length < 20 || githubOAuthClientSecret.length > 512 || /[\r\n\0]/.test(githubOAuthClientSecret)) {
+    throw new Error("GitHub OAuth client secret is malformed");
   }
   return {
     clusterBootstrapCode,
@@ -14184,7 +14202,7 @@ function validatePlatformBootstrapSecrets(config, input) {
     ...enrolmentToken ? { enrolmentToken } : {},
     ...backupS3Secret ? { backupS3Secret } : {},
     ...cloudflareTunnelToken ? { cloudflareTunnelToken, cloudflareApiToken } : {},
-    ...githubConfigured ? { githubClientSecret, githubPrivateKeyBase64, githubWebhookSecret } : {}
+    githubOAuthClientSecret
   };
 }
 var platformBootstrapRunner = (config) => config.kind === "platform" && config.database.role === "master";
@@ -14199,6 +14217,7 @@ var STATE_PATH = BOOTSTRAP_STATE_PATH;
 var INTENT_PATH = "/var/lib/forgezero/bootstrap.intent.json";
 var CREDS = "/etc/forgezero/creds";
 var JWT_CREDENTIAL = `${CREDS}/arangodb-jwt.cred`;
+var ARANGO_ROOT_CREDENTIAL = `${CREDS}/arangodb-root-password.cred`;
 var ENROL_CREDENTIAL = `${CREDS}/enrol-token.cred`;
 var TUNNEL_CREDENTIAL = `${CREDS}/CF_TUNNEL_CONNECTOR_TOKEN.cred`;
 var CF_API_CREDENTIAL = `${CREDS}/CF_API_TOKEN.cred`;
@@ -14484,7 +14503,7 @@ WantedBy=multi-user.target
 function databaseVerifyUnit(config) {
   const { address } = config.database;
   return `[Unit]
-Description=Verify ForgeZero ArangoDB Community 3.11.14 writable Coordinator
+Description=Secure and verify ForgeZero ArangoDB Community 3.11.14 writable Coordinator
 Requires=forgezero-db.service
 After=forgezero-db.service
 PartOf=forgezero-db.service
@@ -14494,7 +14513,9 @@ Type=oneshot
 User=arangodb
 Group=arangodb
 LoadCredentialEncrypted=arangodb-jwt:${JWT_CREDENTIAL}
-ExecStart=/usr/bin/arangosh --server.endpoint tcp://${unitEscape(address)}:8529 --server.jwt-secret-keyfile %d/arangodb-jwt --javascript.execute-string 'const c=require("@arangodb").db._connection;let last;let ok=false;for(let i=0;i<90;i++){try{const v=c.GET("/_api/version?details=true");const s=c.GET("/_admin/status");const m=c.GET("/_admin/server/mode");if(!v.error&&v.version==="3.11.14"&&v.details&&v.details.license==="community"&&!s.error&&s.serverInfo&&s.serverInfo.role==="COORDINATOR"&&!m.error&&m.mode==="default"){ok=true;break;}last={v,s,m};}catch(e){last=String(e);}require("internal").wait(2);}if(!ok)throw new Error("writable Community Coordinator verification failed: "+JSON.stringify(last));'
+LoadCredentialEncrypted=arangodb-root-password:${ARANGO_ROOT_CREDENTIAL}
+ExecStart=/usr/bin/arangosh --server.endpoint tcp://${unitEscape(address)}:8529 --server.jwt-secret-keyfile %d/arangodb-jwt --javascript.execute-string 'const c=require("@arangodb").db._connection;let last;let ok=false;for(let i=0;i<90;i++){try{const v=c.GET("/_api/version?details=true");const s=c.GET("/_admin/status");const m=c.GET("/_admin/server/mode");if(!v.error&&v.version==="3.11.14"&&v.details&&v.details.license==="community"&&!s.error&&s.serverInfo&&s.serverInfo.role==="COORDINATOR"&&!m.error&&m.mode==="default"){ok=true;break;}last={v,s,m};}catch(e){last=String(e);}require("internal").wait(2);}if(!ok)throw new Error("writable Community Coordinator verification failed: "+JSON.stringify(last));const password=require("fs").read("%d/arangodb-root-password").trim();if(password.length<48)throw new Error("ArangoDB root credential is malformed");require("@arangodb/users").update("root",password,true);'
+ExecStart=/usr/local/bin/fz-agent database-auth-verify --endpoint=http://${unitEscape(address)}:8529
 RemainAfterExit=yes
 TimeoutStartSec=200
 NoNewPrivileges=true
@@ -14961,6 +14982,11 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     if (nginx.exitCode !== 0)
       problems.push("nginx configuration is invalid");
     if (state.databaseRole !== "none") {
+      for (const credential of [JWT_CREDENTIAL, ARANGO_ROOT_CREDENTIAL]) {
+        services[credential] = host.exists(credential);
+        if (!services[credential])
+          problems.push(`${credential} is missing`);
+      }
       const unitPath = "/etc/systemd/system/forgezero-db.service";
       const expectsNoAgency = state.databaseAgency === "none";
       const unitHasNoAgency = host.exists(unitPath) && host.read(unitPath).includes("--cluster.start-agent=false");
@@ -15100,9 +15126,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       backup: checked4.backupS3Secret,
       cloudflareTunnelToken: checked4.cloudflareTunnelToken,
       cloudflareApiToken: checked4.cloudflareApiToken,
-      githubClientSecret: checked4.githubClientSecret,
-      githubPrivateKey: checked4.githubPrivateKeyBase64 ? Buffer.from(checked4.githubPrivateKeyBase64, "base64").toString("utf8") : undefined,
-      githubWebhookSecret: checked4.githubWebhookSecret
+      githubOAuthClientSecret: checked4.githubOAuthClientSecret
     };
   })() : undefined;
   const enrolledPrivate = config.kind === "enrolled-compute" ? validateEnrolledComputeBootstrapSecrets(config, secrets) : undefined;
@@ -15195,14 +15219,15 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     if (!host.exists(JWT_CREDENTIAL)) {
       await seal(host, "arangodb-jwt", JWT_CREDENTIAL, derive(root, "forgezero/cluster/arangodb-jwt/v1"));
     }
+    if (!host.exists(ARANGO_ROOT_CREDENTIAL)) {
+      await seal(host, "arangodb-root-password", ARANGO_ROOT_CREDENTIAL, `fzr_${derive(root, "forgezero/cluster/arangodb-root-password/v1")}`);
+    }
     await seal(host, "seed-sync-root", SEED_CREDENTIAL, derive(root, "forgezero/cluster/seed-mesh/v1"));
     await seal(host, "backup-recovery-root", BACKUP_RECOVERY_CREDENTIAL, derive(root, "forgezero/backup/recovery-root/v1"));
     const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "fz_smtp.password" : config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : undefined;
     for (const [name, source] of Object.entries({
       ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
-      "fz_github.clientSecret": platformPrivate.githubClientSecret,
-      "fz_github.privateKey": platformPrivate.githubPrivateKey,
-      "fz_github.webhookSecret": platformPrivate.githubWebhookSecret,
+      "fz_oauth.github.clientSecret": platformPrivate.githubOAuthClientSecret,
       "backup.s3.secretAccessKey": platformPrivate.backup
     })) {
       if (source) {
@@ -15219,7 +15244,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const credentials = platformApiCredentialSpecs({
       emailProvider: runtime.environment.email?.provider,
       cloudflareKv: cloudflareConfigured,
-      githubApp: Boolean(runtime.environment.githubApp),
+      githubOAuth: true,
       realtime: Boolean(runtime.environment.realtime)
     });
     const units = renderPlatformApiUnits({
@@ -15467,6 +15492,7 @@ function strictBootstrapDocument(value) {
       "agentOtlpEndpoint",
       "custodianEmail",
       "email",
+      "githubOAuth",
       "deployProfile",
       "otlpFlushIntervalMs",
       "otlpTraceSampleRatio",
@@ -15477,8 +15503,13 @@ function strictBootstrapDocument(value) {
       "databaseReadPreferredCoordinators"
     ], "runtime environment");
     const environment = runtime.environment;
+    exactKeys2(environment.githubOAuth, ["clientId"], "GitHub OAuth config");
     if (environment.initialInventory !== undefined) {
-      const inventory = exactKeys2(environment.initialInventory, ["metalHostname", "region", "computes", "attestation", "deployment"], "initial inventory");
+      const inventory = exactKeys2(environment.initialInventory, ["metalHostname", "metalIdentity", "region", "computes", "attestation", "deployment"], "initial inventory");
+      if (inventory.metalIdentity !== undefined) {
+        const identity = exactKeys2(inventory.metalIdentity, ["nodeKey", "publicKeys"], "initial Metal identity");
+        exactKeys2(identity.publicKeys, ["ed25519", "mlDsa"], "initial Metal public keys");
+      }
       exactKeys2(inventory.region, ["key", "label", "country", "city", "confidentialCapable"], "initial inventory region");
       if (inventory.attestation !== undefined) {
         const attestation = exactKeys2(inventory.attestation, ["measurement", "tcbFloor"], "initial attestation evidence");
@@ -18178,7 +18209,7 @@ function forgeZeroLaunchTemplate(profile, guests, bundle, owner) {
         otlpTraceSampleRatio: 0.1,
         custodianEmail: owner.custodianEmail,
         email: owner.email,
-        ...owner.githubApp ? { githubApp: owner.githubApp } : {},
+        githubOAuth: owner.githubOAuth,
         deployProfile: profile.environment
       },
       serviceUser: "forgezero-api",
@@ -18535,6 +18566,52 @@ function planAppBuild(input) {
   };
 }
 
+// src/platform-launch-env.ts
+import { lstatSync as lstatSync10, readFileSync as readFileSync16 } from "fs";
+import { resolve as resolve12 } from "path";
+function readPlatformLaunchEnvironment(path) {
+  const absolute2 = resolve12(path);
+  const stat2 = lstatSync10(absolute2);
+  if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.nlink !== 1 || typeof process.getuid === "function" && stat2.uid !== process.getuid() || (stat2.mode & 63) !== 0) {
+    throw new Error(`bootstrap secret environment must be one owner-only regular file: ${absolute2}`);
+  }
+  const values = new Map;
+  for (const [index, raw] of readFileSync16(absolute2, "utf8").split(/\r?\n/).entries()) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    const match = line.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!match)
+      throw new Error(`invalid environment assignment at ${absolute2}:${index + 1}`);
+    if (values.has(match[1]))
+      throw new Error(`duplicate environment assignment ${match[1]} at ${absolute2}:${index + 1}`);
+    let value = match[2].trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    values.set(match[1], value);
+  }
+  const requiredValue = (name) => {
+    const value = values.get(name)?.trim();
+    if (!value)
+      throw new Error(`bootstrap secret environment is missing ${name}`);
+    return value;
+  };
+  const githubOAuth = { clientId: requiredValue("FZ_GITHUB_OAUTH_CLIENT_ID") };
+  const owner = {
+    custodianEmail: "info@axxra.in",
+    email: { provider: "jetemail", from: "noreply@forgezero.net", eu: false },
+    githubOAuth
+  };
+  return {
+    owner,
+    emailSecret: requiredValue("FZ_JETEMAIL_API_KEY"),
+    cloudflareTunnelToken: requiredValue("CF_TUNNEL_TOKEN"),
+    cloudflareApiToken: requiredValue("CF_API_TOKEN"),
+    githubOAuthClientSecret: requiredValue("FZ_GITHUB_OAUTH_CLIENT_SECRET")
+  };
+}
+
 // src/cli/index.ts
 var DEFAULT_MODE = (THRESHOLD_MODES.find((mode) => mode.threshold === 1 && mode.total === 1) ?? THRESHOLD_MODES[0]).id;
 var PACKAGED_AGENT_BIN2 = operatorPackagedAgentPath();
@@ -18847,7 +18924,7 @@ async function api(options, path, init) {
   return { status: response.status, body };
 }
 function sleep(ms) {
-  return new Promise((resolve13) => setTimeout(resolve13, ms));
+  return new Promise((resolve14) => setTimeout(resolve14, ms));
 }
 function browserCommand(url) {
   if (process.platform === "darwin")
@@ -18932,7 +19009,7 @@ function requireSession() {
 function readOwnerOnlySecret(path, label) {
   let metadata;
   try {
-    metadata = lstatSync10(path);
+    metadata = lstatSync11(path);
   } catch {
     throw new Error(`The ${label} file ${path} is unreadable.`);
   }
@@ -18946,7 +19023,7 @@ function readOwnerOnlySecret(path, label) {
   if (uid !== undefined && uid !== 0 && metadata.uid !== uid) {
     throw new Error(`The ${label} file ${path} is not owned by the current user.`);
   }
-  const value = readFileSync16(path, "utf8").trim();
+  const value = readFileSync17(path, "utf8").trim();
   if (!value)
     throw new Error(`The ${label} file ${path} is empty.`);
   return value;
@@ -19127,7 +19204,7 @@ async function cmdApi(options, args) {
     let body = undefined;
     if (options.data !== undefined && options.dataFile)
       throw new Error("Use only one of --data or --data-file.");
-    const encoded = options.data === "-" ? await Bun.stdin.text() : options.dataFile ? readFileSync16(options.dataFile, "utf8") : options.data;
+    const encoded = options.data === "-" ? await Bun.stdin.text() : options.dataFile ? readFileSync17(options.dataFile, "utf8") : options.data;
     if (encoded !== undefined)
       body = JSON.parse(encoded);
     const result = await api(options, `${url.pathname}${url.search}`, { method, body });
@@ -19306,7 +19383,7 @@ async function cmdAgent(options, args) {
       out.line();
       out.line("  Compatibility SSH deploy public key:");
       out.line();
-      out.line(`  ${readFileSync16(gitIdentity.gitPublicKeyPath, "utf8").trim()}`);
+      out.line(`  ${readFileSync17(gitIdentity.gitPublicKeyPath, "utf8").trim()}`);
       out.line();
     }
     return 0;
@@ -19346,78 +19423,6 @@ async function bootstrapSecret(question) {
     throw new Error(`${question} was not provided`);
   return value;
 }
-function readPlatformLaunchEnvironment(path) {
-  const absolute2 = resolve12(path);
-  const stat2 = lstatSync10(absolute2);
-  if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.nlink !== 1 || typeof process.getuid === "function" && stat2.uid !== process.getuid() || (stat2.mode & 63) !== 0) {
-    throw new Error(`bootstrap secret environment must be one owner-only regular file: ${absolute2}`);
-  }
-  const values = new Map;
-  for (const [index, raw] of readFileSync16(absolute2, "utf8").split(/\r?\n/).entries()) {
-    const line = raw.trim();
-    if (!line || line.startsWith("#"))
-      continue;
-    const match = line.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
-    if (!match)
-      throw new Error(`invalid environment assignment at ${absolute2}:${index + 1}`);
-    if (values.has(match[1]))
-      throw new Error(`duplicate environment assignment ${match[1]} at ${absolute2}:${index + 1}`);
-    let value = match[2].trim();
-    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-      value = value.slice(1, -1);
-    }
-    values.set(match[1], value);
-  }
-  const requiredValue = (name) => {
-    const value = values.get(name)?.trim();
-    if (!value)
-      throw new Error(`bootstrap secret environment is missing ${name}`);
-    return value;
-  };
-  const provider = requiredValue("FZ_EMAIL_PROVIDER");
-  if (provider !== "smtp" && provider !== "jetemail")
-    throw new Error("FZ_EMAIL_PROVIDER must be smtp or jetemail");
-  const smtpPort = provider === "smtp" ? Number(requiredValue("FZ_SMTP_PORT")) : undefined;
-  if (smtpPort !== undefined && (!Number.isInteger(smtpPort) || smtpPort < 1 || smtpPort > 65535)) {
-    throw new Error("FZ_SMTP_PORT must be an integer from 1 through 65535");
-  }
-  const githubEnabled = (values.get("FZ_GITHUB_ENABLED") ?? "false").trim().toLowerCase() === "true";
-  const githubApp = githubEnabled ? {
-    clientId: requiredValue("FZ_GITHUB_CLIENT_ID"),
-    appId: requiredValue("FZ_GITHUB_APP_ID"),
-    slug: requiredValue("FZ_GITHUB_APP_SLUG")
-  } : undefined;
-  const owner = provider === "jetemail" ? {
-    custodianEmail: requiredValue("FZ_BOOTSTRAP_CUSTODIAN_EMAIL"),
-    email: {
-      provider,
-      from: requiredValue("FZ_EMAIL_FROM"),
-      eu: (values.get("FZ_JETEMAIL_EU") ?? "false").trim().toLowerCase() === "true"
-    },
-    ...githubApp ? { githubApp } : {}
-  } : {
-    custodianEmail: requiredValue("FZ_BOOTSTRAP_CUSTODIAN_EMAIL"),
-    email: {
-      provider,
-      from: requiredValue("FZ_EMAIL_FROM"),
-      host: requiredValue("FZ_SMTP_HOST"),
-      port: smtpPort,
-      user: requiredValue("FZ_SMTP_USER")
-    },
-    ...githubApp ? { githubApp } : {}
-  };
-  return {
-    owner,
-    emailSecret: requiredValue(provider === "jetemail" ? "FZ_JETEMAIL_API_KEY" : "FZ_SMTP_PASSWORD"),
-    cloudflareTunnelToken: requiredValue("CF_TUNNEL_TOKEN"),
-    cloudflareApiToken: requiredValue("CF_API_TOKEN"),
-    ...githubEnabled ? {
-      githubClientSecret: requiredValue("FZ_GITHUB_CLIENT_SECRET"),
-      githubPrivateKeyBase64: requiredValue("FZ_GITHUB_PRIVATE_KEY_BASE64"),
-      githubWebhookSecret: requiredValue("FZ_GITHUB_WEBHOOK_SECRET")
-    } : {}
-  };
-}
 async function promptPlatformBootstrapSecrets(config, generatedClusterBootstrapCode) {
   return validatePlatformBootstrapSecrets(config, {
     clusterBootstrapCode: generatedClusterBootstrapCode ?? await bootstrapSecret("Shared 64-hex cluster bootstrap code"),
@@ -19428,11 +19433,7 @@ async function promptPlatformBootstrapSecrets(config, generatedClusterBootstrapC
       cloudflareTunnelToken: await bootstrapSecret("CF_TUNNEL_TOKEN"),
       cloudflareApiToken: await bootstrapSecret("CF_API_TOKEN")
     } : {},
-    ...config.runtime.environment.githubApp ? {
-      githubClientSecret: await bootstrapSecret("GitHub App client secret"),
-      githubPrivateKeyBase64: await bootstrapSecret("GitHub App RSA private key (base64)"),
-      githubWebhookSecret: await bootstrapSecret("GitHub App webhook secret")
-    } : {}
+    githubOAuthClientSecret: await bootstrapSecret("GitHub OAuth client secret")
   });
 }
 var bootstrapList = (question, fallback) => bootstrapAnswer(question, fallback).split(",").map((value) => value.trim()).filter(Boolean);
@@ -19493,7 +19494,7 @@ function interactiveMetalBootstrap() {
   });
 }
 function writeBootstrapConfig(path, config) {
-  if (!isAbsolute7(path) || resolve12(path) !== path)
+  if (!isAbsolute7(path) || resolve13(path) !== path)
     throw new Error("--output must be a canonical absolute path");
   mkdirSync13(dirname14(path), { recursive: true, mode: 448 });
   writeFileSync13(path, `${JSON.stringify(config, null, 2)}
@@ -19557,11 +19558,11 @@ async function interactiveCloudflareBootstrap() {
   });
 }
 function genesisOutputDirectory(path) {
-  if (!isAbsolute7(path) || resolve12(path) !== path)
+  if (!isAbsolute7(path) || resolve13(path) !== path)
     throw new Error("--output must be a canonical absolute directory");
   if (!existsSync13(path))
     mkdirSync13(path, { recursive: true, mode: 448 });
-  const metadata = lstatSync10(path);
+  const metadata = lstatSync11(path);
   const uid = process.getuid?.();
   if (!metadata.isDirectory() || metadata.isSymbolicLink() || (metadata.mode & 63) !== 0 || uid !== undefined && uid !== 0 && metadata.uid !== uid) {
     throw new Error("platform genesis output must be an owner-only directory owned by the current user");
@@ -19730,34 +19731,11 @@ function selectedForgeZeroLaunchEnvironment(value) {
   return value;
 }
 function forgeZeroLaunchOwnerInput() {
-  const custodianEmail = bootstrapAnswer("First custodian email");
-  const provider = bootstrapAnswer("Bootstrap email provider (smtp/jetemail)", "jetemail");
-  if (provider !== "smtp" && provider !== "jetemail") {
-    throw new Error("Bootstrap email provider must be smtp or jetemail");
-  }
-  const from = bootstrapAnswer("Bootstrap email From address");
-  const githubApp = bootstrapBoolean("Configure the platform GitHub App now?", "no") ? {
-    clientId: bootstrapAnswer("GitHub App client ID"),
-    appId: bootstrapAnswer("GitHub App ID"),
-    slug: bootstrapAnswer("GitHub App slug")
-  } : undefined;
-  if (provider === "jetemail") {
-    return {
-      custodianEmail,
-      email: { provider, from, eu: bootstrapBoolean("Use JetEmail EU processing?", "no") },
-      ...githubApp ? { githubApp } : {}
-    };
-  }
+  const githubOAuth = { clientId: bootstrapAnswer("GitHub OAuth client ID") };
   return {
-    custodianEmail,
-    email: {
-      provider,
-      from,
-      host: bootstrapAnswer("SMTP host"),
-      port: bootstrapNumber("SMTP port", "587"),
-      user: bootstrapAnswer("SMTP user")
-    },
-    ...githubApp ? { githubApp } : {}
+    custodianEmail: "info@axxra.in",
+    email: { provider: "jetemail", from: "noreply@forgezero.net", eu: false },
+    githubOAuth
   };
 }
 async function prepareForgeZeroPlatformLaunch(environment, outputDirectory, projectRoot, owner) {
@@ -19772,14 +19750,11 @@ async function prepareForgeZeroPlatformLaunch(environment, outputDirectory, proj
     if (!existsSync13(path))
       throw new Error(`${label} is missing at ${path}`);
   }
-  const root = resolve12(projectRoot);
+  const root = resolve13(projectRoot);
   const nestedApi = join13(root, "api");
   const repositoryRoot = existsSync13(join13(nestedApi, "package.json")) ? nestedApi : root;
   const bundlePath = join13(base, "api.bundle");
-  const bundle = existsSync13(bundlePath) || existsSync13(`${bundlePath}.json`) ? await readBootstrapBundle(bundlePath) : await buildBootstrapBundle({ repositoryRoot, outputPath: bundlePath, branch: profile.branch });
-  if (bundle.manifest.branch !== profile.branch) {
-    throw new Error(`existing bootstrap bundle is for ${bundle.manifest.branch}, expected ${profile.branch}`);
-  }
+  const bundle = await refreshBootstrapBundle({ repositoryRoot, outputPath: bundlePath, branch: profile.branch });
   return writePlatformGenesisFleet(outputDirectory, {
     profile,
     metalRequestFile,
@@ -19829,6 +19804,7 @@ function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint)
   const backupRegion = backupEndpoint ? bootstrapAnswer("Backup S3 region") : undefined;
   const backupBucket = backupEndpoint ? bootstrapAnswer("Backup S3 bucket") : undefined;
   const backupAccessKeyId = backupEndpoint ? bootstrapAnswer("Backup S3 access-key id") : undefined;
+  const githubOAuthClientId = bootstrapAnswer("GitHub OAuth client ID");
   const cloudflareHandoffFile = genesis ? cloudflareHostHandoffPath(genesisCloudflareCheckpoint, computeReference) : bootstrapAnswer("Node-specific Cloudflare host handoff (blank for no public edge)", "");
   const cloudflareNodeName = cloudflareHandoffFile ? genesis ? computeReference : bootstrapAnswer("Cloudflare handoff node name", computeReference) : undefined;
   const databaseNetworkMode = "private-lan";
@@ -19883,6 +19859,7 @@ function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint)
         otlpTraceSampleRatio: 0.1,
         custodianEmail: role === "master" ? bootstrapAnswer("First custodian email") : undefined,
         email: emailProvider === "smtp" ? { provider: "smtp", host: smtpHost, port: smtpPort, user: smtpUser, from: emailFrom } : { provider: "jetemail", from: emailFrom, eu: jetemailEu },
+        githubOAuth: { clientId: githubOAuthClientId },
         ...backupEndpoint && backupRegion && backupBucket && backupAccessKeyId ? {
           backup: { endpoint: backupEndpoint, region: backupRegion, bucket: backupBucket, accessKeyId: backupAccessKeyId }
         } : {},
@@ -19943,11 +19920,7 @@ async function runAttendedPlatformFleet(fleet, apply, generatedClusterBootstrapC
     emailSecret: environmentInput.emailSecret,
     cloudflareTunnelToken: environmentInput.cloudflareTunnelToken,
     cloudflareApiToken: environmentInput.cloudflareApiToken,
-    ...environmentInput.githubClientSecret ? {
-      githubClientSecret: environmentInput.githubClientSecret,
-      githubPrivateKeyBase64: environmentInput.githubPrivateKeyBase64,
-      githubWebhookSecret: environmentInput.githubWebhookSecret
-    } : {}
+    githubOAuthClientSecret: environmentInput.githubOAuthClientSecret
   }) : await promptPlatformBootstrapSecrets(firstConfig, generatedClusterBootstrapCode);
   const cloudflare = await resolveCloudflareBootstrapCommandConfig(fleet.cloudflareConfigFile, {
     tunnelToken: secrets.cloudflareTunnelToken,
@@ -20261,7 +20234,7 @@ async function cmdUnlock(options) {
     if (options.key || options.userExplicit) {
       throw new Error("SSH/user unlock coordinates are not accepted. SSH keys cannot open a WebAuthn-PRF custody envelope; use --phrase-file or --phrase-stdin.");
     }
-    const phraseText = options.phraseFile ? readOwnerOnlySecret(options.phraseFile, "recovery phrase") : options.phraseStdin ? readFileSync16(0, "utf8").trim() : "";
+    const phraseText = options.phraseFile ? readOwnerOnlySecret(options.phraseFile, "recovery phrase") : options.phraseStdin ? readFileSync17(0, "utf8").trim() : "";
     const phrase = phraseText ? phraseText.split(/\s+/) : [];
     if (phrase.length !== 24) {
       throw new Error(`Recovery phrase must contain exactly 24 words; received ${phrase.length}. Use --phrase-file or --phrase-stdin.`);
@@ -20494,7 +20467,7 @@ function projectFromCheckout(options) {
   try {
     return loadConfig({
       cwd: options.projectRoot,
-      readFile: (path) => existsSync13(path) ? readFileSync16(path, "utf8") : undefined
+      readFile: (path) => existsSync13(path) ? readFileSync17(path, "utf8") : undefined
     }).config.project;
   } catch (cause) {
     throw new Error(`No --project was given and the checkout has no usable .fz/config.json: ${cause instanceof Error ? cause.message : String(cause)}`);
@@ -20561,7 +20534,7 @@ async function cmdDeploy(options, args) {
         throw new Error("typed runtime initialization selects its tested software and attestation from --runtime/--isolation; do not combine --software or --attestation");
       }
       initializeTypeScriptDeployment(options.projectRoot, {
-        name: options.projectName ?? basename3(resolve12(options.projectRoot)),
+        name: options.projectName ?? basename3(resolve13(options.projectRoot)),
         force: options.force,
         runtime: options.deployRuntime,
         operatingSystem: options.deployOperatingSystem,
@@ -20616,7 +20589,7 @@ async function cmdDeploy(options, args) {
       return problems.length === 0 ? 0 : 1;
     }
     if (operation === "check" || operation === "sync") {
-      if (existsSync13(resolve12(options.projectRoot, DEPLOY_SOURCE_FILE))) {
+      if (existsSync13(resolve13(options.projectRoot, DEPLOY_SOURCE_FILE))) {
         const expected = await compileDeploymentProject(options.projectRoot, { write: false });
         const actual = inspectCompiledDeployment(options.projectRoot);
         const current2 = canonicalJson(expected.plan) === canonicalJson(actual.plan);
@@ -20692,7 +20665,7 @@ async function cmdDeploy(options, args) {
         branch: options.branch,
         cloneUrl: required(options.cloneUrl, "--clone-url"),
         sourceAuth,
-        ...options.knownHostsFile ? { knownHosts: readFileSync16(options.knownHostsFile, "utf8") } : {},
+        ...options.knownHostsFile ? { knownHosts: readFileSync17(options.knownHostsFile, "utf8") } : {},
         projectKey
       } });
       const pipelineKey2 = String(created.pipelineKey);

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.103";
+var VERSION = "0.1.108";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";