@forgezero/agent 0.1.107 → 0.1.108

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.107";
+var VERSION3 = "0.1.108";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.d.ts

@@ -115,10 +115,7 @@ export interface PlatformBootstrapSecrets {
     backupS3Secret?: string;
     cloudflareTunnelToken?: string;
     cloudflareApiToken?: string;
-    githubClientSecret?: string;
-    /** One-line base64 form accepted by prompts/env; decoded before systemd sealing. */
-    githubPrivateKeyBase64?: string;
-    githubWebhookSecret?: string;
+    githubOAuthClientSecret: string;
 }
 export interface EnrolledComputeBootstrapSecrets {
     enrolmentToken: string;

package/dist/bootstrap.js

@@ -1426,7 +1426,7 @@ async function refreshBootstrapBundle(input, exec = run) {
 }
 
 // src/bootstrap.ts
-import { createHash as createHash2, createHmac as createHmac2, createPrivateKey, randomBytes as randomBytes3 } from "crypto";
+import { createHash as createHash2, createHmac as createHmac2, randomBytes as randomBytes3 } from "crypto";
 import {
   chmodSync as chmodSync3,
   existsSync as existsSync5,
@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.107";
+var VERSION = "0.1.108";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3228,10 +3228,8 @@ function validatePlatformSharedEnvironment(input) {
   } else if (input.email !== undefined) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
-  if (input.githubApp) {
-    if (!/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubApp.clientId) || !/^[1-9][0-9]{0,19}$/.test(input.githubApp.appId) || !/^[a-z0-9][a-z0-9-]{0,99}$/.test(input.githubApp.slug)) {
-      throw new Error("GitHub App client id, app id or slug is malformed.");
-    }
+  if (!input.githubOAuth || !/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubOAuth.clientId)) {
+    throw new Error("GitHub OAuth client id is malformed.");
   }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
   if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
@@ -3363,9 +3361,7 @@ function renderPlatformSharedEnvironment(input) {
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
     FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
-    FZ_GITHUB_CLIENT_ID: value.githubApp?.clientId ?? "",
-    FZ_GITHUB_APP_ID: value.githubApp?.appId ?? "",
-    FZ_GITHUB_APP_SLUG: value.githubApp?.slug ?? "",
+    FZ_GITHUB_OAUTH_CLIENT_ID: value.githubOAuth.clientId,
     FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
@@ -3377,9 +3373,7 @@ function platformApiCredentialSpecs(options) {
   const optional = [
     ["fz_smtp.password", options.emailProvider === "smtp"],
     ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
-    ["fz_github.clientSecret", options.githubApp],
-    ["fz_github.privateKey", options.githubApp],
-    ["fz_github.webhookSecret", options.githubApp],
+    ["fz_oauth.github.clientSecret", options.githubOAuth],
     ["CF_API_TOKEN", options.cloudflareKv],
     ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],
@@ -3783,9 +3777,7 @@ function validatePlatformBootstrapSecrets(config, input) {
     "backupS3Secret",
     "cloudflareTunnelToken",
     "cloudflareApiToken",
-    "githubClientSecret",
-    "githubPrivateKeyBase64",
-    "githubWebhookSecret"
+    "githubOAuthClientSecret"
   ];
   const unknown = Object.keys(source).filter((key) => !allowed.includes(key));
   if (unknown.length)
@@ -3796,9 +3788,7 @@ function validatePlatformBootstrapSecrets(config, input) {
   const backupS3Secret = typeof source.backupS3Secret === "string" ? source.backupS3Secret.trim() : undefined;
   const cloudflareTunnelToken = typeof source.cloudflareTunnelToken === "string" ? source.cloudflareTunnelToken.trim() : undefined;
   const cloudflareApiToken = typeof source.cloudflareApiToken === "string" ? source.cloudflareApiToken.trim() : undefined;
-  const githubClientSecret = typeof source.githubClientSecret === "string" ? source.githubClientSecret.trim() : undefined;
-  const githubPrivateKeyBase64 = typeof source.githubPrivateKeyBase64 === "string" ? source.githubPrivateKeyBase64.trim() : undefined;
-  const githubWebhookSecret = typeof source.githubWebhookSecret === "string" ? source.githubWebhookSecret.trim() : undefined;
+  const githubOAuthClientSecret = typeof source.githubOAuthClientSecret === "string" ? source.githubOAuthClientSecret.trim() : "";
   if (!/^[a-f0-9]{64}$/i.test(clusterBootstrapCode))
     throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
   if (!emailSecret || emailSecret.length > 16384 || /[\r\n\0]/.test(emailSecret))
@@ -3818,21 +3808,8 @@ function validatePlatformBootstrapSecrets(config, input) {
   }
   if (cloudflareTunnelToken)
     validateCloudflareBootstrapSecretPair({ cloudflareTunnelToken, cloudflareApiToken });
-  const githubConfigured = Boolean(config.runtime.environment.githubApp);
-  if (githubConfigured !== Boolean(githubClientSecret && githubPrivateKeyBase64 && githubWebhookSecret)) {
-    throw new Error("GitHub App coordinates require client secret, private key and webhook secret together");
-  }
-  if (githubConfigured) {
-    if (githubClientSecret.length < 20 || githubClientSecret.length > 512 || /[\r\n\0]/.test(githubClientSecret) || githubWebhookSecret.length < 32 || githubWebhookSecret.length > 512 || /[\r\n\0]/.test(githubWebhookSecret)) {
-      throw new Error("GitHub App client or webhook secret is malformed");
-    }
-    try {
-      const pem = Buffer.from(githubPrivateKeyBase64, "base64").toString("utf8");
-      if (createPrivateKey(pem).asymmetricKeyType !== "rsa")
-        throw new Error("not RSA");
-    } catch {
-      throw new Error("GitHub App private key must be a base64-encoded RSA private key");
-    }
+  if (githubOAuthClientSecret.length < 20 || githubOAuthClientSecret.length > 512 || /[\r\n\0]/.test(githubOAuthClientSecret)) {
+    throw new Error("GitHub OAuth client secret is malformed");
   }
   return {
     clusterBootstrapCode,
@@ -3840,7 +3817,7 @@ function validatePlatformBootstrapSecrets(config, input) {
     ...enrolmentToken ? { enrolmentToken } : {},
     ...backupS3Secret ? { backupS3Secret } : {},
     ...cloudflareTunnelToken ? { cloudflareTunnelToken, cloudflareApiToken } : {},
-    ...githubConfigured ? { githubClientSecret, githubPrivateKeyBase64, githubWebhookSecret } : {}
+    githubOAuthClientSecret
   };
 }
 var platformBootstrapRunner = (config) => config.kind === "platform" && config.database.role === "master";
@@ -4764,9 +4741,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       backup: checked4.backupS3Secret,
       cloudflareTunnelToken: checked4.cloudflareTunnelToken,
       cloudflareApiToken: checked4.cloudflareApiToken,
-      githubClientSecret: checked4.githubClientSecret,
-      githubPrivateKey: checked4.githubPrivateKeyBase64 ? Buffer.from(checked4.githubPrivateKeyBase64, "base64").toString("utf8") : undefined,
-      githubWebhookSecret: checked4.githubWebhookSecret
+      githubOAuthClientSecret: checked4.githubOAuthClientSecret
     };
   })() : undefined;
   const enrolledPrivate = config.kind === "enrolled-compute" ? validateEnrolledComputeBootstrapSecrets(config, secrets) : undefined;
@@ -4867,9 +4842,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "fz_smtp.password" : config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : undefined;
     for (const [name, source] of Object.entries({
       ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
-      "fz_github.clientSecret": platformPrivate.githubClientSecret,
-      "fz_github.privateKey": platformPrivate.githubPrivateKey,
-      "fz_github.webhookSecret": platformPrivate.githubWebhookSecret,
+      "fz_oauth.github.clientSecret": platformPrivate.githubOAuthClientSecret,
       "backup.s3.secretAccessKey": platformPrivate.backup
     })) {
       if (source) {
@@ -4886,7 +4859,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const credentials = platformApiCredentialSpecs({
       emailProvider: runtime.environment.email?.provider,
       cloudflareKv: cloudflareConfigured,
-      githubApp: Boolean(runtime.environment.githubApp),
+      githubOAuth: true,
       realtime: Boolean(runtime.environment.realtime)
     });
     const units = renderPlatformApiUnits({
@@ -5134,6 +5107,7 @@ function strictBootstrapDocument(value) {
       "agentOtlpEndpoint",
       "custodianEmail",
       "email",
+      "githubOAuth",
       "deployProfile",
       "otlpFlushIntervalMs",
       "otlpTraceSampleRatio",
@@ -5144,6 +5118,7 @@ function strictBootstrapDocument(value) {
       "databaseReadPreferredCoordinators"
     ], "runtime environment");
     const environment = runtime.environment;
+    exactKeys(environment.githubOAuth, ["clientId"], "GitHub OAuth config");
     if (environment.initialInventory !== undefined) {
       const inventory = exactKeys(environment.initialInventory, ["metalHostname", "metalIdentity", "region", "computes", "attestation", "deployment"], "initial inventory");
       if (inventory.metalIdentity !== undefined) {

package/dist/fz-agent.js

@@ -9528,7 +9528,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.107";
+var VERSION2 = "0.1.108";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4841,7 +4841,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.107";
+var VERSION2 = "0.1.108";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -12058,7 +12058,7 @@ function removeSession(api, realm, path = defaultSessionPath()) {
 }
 
 // src/bootstrap.ts
-import { createHash as createHash4, createHmac as createHmac2, createPrivateKey, randomBytes as randomBytes7 } from "crypto";
+import { createHash as createHash4, createHmac as createHmac2, randomBytes as randomBytes7 } from "crypto";
 import {
   chmodSync as chmodSync4,
   existsSync as existsSync9,
@@ -12337,10 +12337,8 @@ function validatePlatformSharedEnvironment(input) {
   } else if (input.email !== undefined) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
-  if (input.githubApp) {
-    if (!/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubApp.clientId) || !/^[1-9][0-9]{0,19}$/.test(input.githubApp.appId) || !/^[a-z0-9][a-z0-9-]{0,99}$/.test(input.githubApp.slug)) {
-      throw new Error("GitHub App client id, app id or slug is malformed.");
-    }
+  if (!input.githubOAuth || !/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubOAuth.clientId)) {
+    throw new Error("GitHub OAuth client id is malformed.");
   }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
   if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
@@ -12472,9 +12470,7 @@ function renderPlatformSharedEnvironment(input) {
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
     FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
-    FZ_GITHUB_CLIENT_ID: value.githubApp?.clientId ?? "",
-    FZ_GITHUB_APP_ID: value.githubApp?.appId ?? "",
-    FZ_GITHUB_APP_SLUG: value.githubApp?.slug ?? "",
+    FZ_GITHUB_OAUTH_CLIENT_ID: value.githubOAuth.clientId,
     FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
@@ -12486,9 +12482,7 @@ function platformApiCredentialSpecs(options) {
   const optional = [
     ["fz_smtp.password", options.emailProvider === "smtp"],
     ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
-    ["fz_github.clientSecret", options.githubApp],
-    ["fz_github.privateKey", options.githubApp],
-    ["fz_github.webhookSecret", options.githubApp],
+    ["fz_oauth.github.clientSecret", options.githubOAuth],
     ["CF_API_TOKEN", options.cloudflareKv],
     ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],
@@ -14168,9 +14162,7 @@ function validatePlatformBootstrapSecrets(config, input) {
     "backupS3Secret",
     "cloudflareTunnelToken",
     "cloudflareApiToken",
-    "githubClientSecret",
-    "githubPrivateKeyBase64",
-    "githubWebhookSecret"
+    "githubOAuthClientSecret"
   ];
   const unknown = Object.keys(source).filter((key) => !allowed.includes(key));
   if (unknown.length)
@@ -14181,9 +14173,7 @@ function validatePlatformBootstrapSecrets(config, input) {
   const backupS3Secret = typeof source.backupS3Secret === "string" ? source.backupS3Secret.trim() : undefined;
   const cloudflareTunnelToken = typeof source.cloudflareTunnelToken === "string" ? source.cloudflareTunnelToken.trim() : undefined;
   const cloudflareApiToken = typeof source.cloudflareApiToken === "string" ? source.cloudflareApiToken.trim() : undefined;
-  const githubClientSecret = typeof source.githubClientSecret === "string" ? source.githubClientSecret.trim() : undefined;
-  const githubPrivateKeyBase64 = typeof source.githubPrivateKeyBase64 === "string" ? source.githubPrivateKeyBase64.trim() : undefined;
-  const githubWebhookSecret = typeof source.githubWebhookSecret === "string" ? source.githubWebhookSecret.trim() : undefined;
+  const githubOAuthClientSecret = typeof source.githubOAuthClientSecret === "string" ? source.githubOAuthClientSecret.trim() : "";
   if (!/^[a-f0-9]{64}$/i.test(clusterBootstrapCode))
     throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
   if (!emailSecret || emailSecret.length > 16384 || /[\r\n\0]/.test(emailSecret))
@@ -14203,21 +14193,8 @@ function validatePlatformBootstrapSecrets(config, input) {
   }
   if (cloudflareTunnelToken)
     validateCloudflareBootstrapSecretPair({ cloudflareTunnelToken, cloudflareApiToken });
-  const githubConfigured = Boolean(config.runtime.environment.githubApp);
-  if (githubConfigured !== Boolean(githubClientSecret && githubPrivateKeyBase64 && githubWebhookSecret)) {
-    throw new Error("GitHub App coordinates require client secret, private key and webhook secret together");
-  }
-  if (githubConfigured) {
-    if (githubClientSecret.length < 20 || githubClientSecret.length > 512 || /[\r\n\0]/.test(githubClientSecret) || githubWebhookSecret.length < 32 || githubWebhookSecret.length > 512 || /[\r\n\0]/.test(githubWebhookSecret)) {
-      throw new Error("GitHub App client or webhook secret is malformed");
-    }
-    try {
-      const pem = Buffer.from(githubPrivateKeyBase64, "base64").toString("utf8");
-      if (createPrivateKey(pem).asymmetricKeyType !== "rsa")
-        throw new Error("not RSA");
-    } catch {
-      throw new Error("GitHub App private key must be a base64-encoded RSA private key");
-    }
+  if (githubOAuthClientSecret.length < 20 || githubOAuthClientSecret.length > 512 || /[\r\n\0]/.test(githubOAuthClientSecret)) {
+    throw new Error("GitHub OAuth client secret is malformed");
   }
   return {
     clusterBootstrapCode,
@@ -14225,7 +14202,7 @@ function validatePlatformBootstrapSecrets(config, input) {
     ...enrolmentToken ? { enrolmentToken } : {},
     ...backupS3Secret ? { backupS3Secret } : {},
     ...cloudflareTunnelToken ? { cloudflareTunnelToken, cloudflareApiToken } : {},
-    ...githubConfigured ? { githubClientSecret, githubPrivateKeyBase64, githubWebhookSecret } : {}
+    githubOAuthClientSecret
   };
 }
 var platformBootstrapRunner = (config) => config.kind === "platform" && config.database.role === "master";
@@ -15149,9 +15126,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       backup: checked4.backupS3Secret,
       cloudflareTunnelToken: checked4.cloudflareTunnelToken,
       cloudflareApiToken: checked4.cloudflareApiToken,
-      githubClientSecret: checked4.githubClientSecret,
-      githubPrivateKey: checked4.githubPrivateKeyBase64 ? Buffer.from(checked4.githubPrivateKeyBase64, "base64").toString("utf8") : undefined,
-      githubWebhookSecret: checked4.githubWebhookSecret
+      githubOAuthClientSecret: checked4.githubOAuthClientSecret
     };
   })() : undefined;
   const enrolledPrivate = config.kind === "enrolled-compute" ? validateEnrolledComputeBootstrapSecrets(config, secrets) : undefined;
@@ -15252,9 +15227,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "fz_smtp.password" : config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : undefined;
     for (const [name, source] of Object.entries({
       ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
-      "fz_github.clientSecret": platformPrivate.githubClientSecret,
-      "fz_github.privateKey": platformPrivate.githubPrivateKey,
-      "fz_github.webhookSecret": platformPrivate.githubWebhookSecret,
+      "fz_oauth.github.clientSecret": platformPrivate.githubOAuthClientSecret,
       "backup.s3.secretAccessKey": platformPrivate.backup
     })) {
       if (source) {
@@ -15271,7 +15244,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const credentials = platformApiCredentialSpecs({
       emailProvider: runtime.environment.email?.provider,
       cloudflareKv: cloudflareConfigured,
-      githubApp: Boolean(runtime.environment.githubApp),
+      githubOAuth: true,
       realtime: Boolean(runtime.environment.realtime)
     });
     const units = renderPlatformApiUnits({
@@ -15519,6 +15492,7 @@ function strictBootstrapDocument(value) {
       "agentOtlpEndpoint",
       "custodianEmail",
       "email",
+      "githubOAuth",
       "deployProfile",
       "otlpFlushIntervalMs",
       "otlpTraceSampleRatio",
@@ -15529,6 +15503,7 @@ function strictBootstrapDocument(value) {
       "databaseReadPreferredCoordinators"
     ], "runtime environment");
     const environment = runtime.environment;
+    exactKeys2(environment.githubOAuth, ["clientId"], "GitHub OAuth config");
     if (environment.initialInventory !== undefined) {
       const inventory = exactKeys2(environment.initialInventory, ["metalHostname", "metalIdentity", "region", "computes", "attestation", "deployment"], "initial inventory");
       if (inventory.metalIdentity !== undefined) {
@@ -18234,7 +18209,7 @@ function forgeZeroLaunchTemplate(profile, guests, bundle, owner) {
         otlpTraceSampleRatio: 0.1,
         custodianEmail: owner.custodianEmail,
         email: owner.email,
-        ...owner.githubApp ? { githubApp: owner.githubApp } : {},
+        githubOAuth: owner.githubOAuth,
         deployProfile: profile.environment
       },
       serviceUser: "forgezero-api",
@@ -18594,16 +18569,6 @@ function planAppBuild(input) {
 // src/platform-launch-env.ts
 import { lstatSync as lstatSync10, readFileSync as readFileSync16 } from "fs";
 import { resolve as resolve12 } from "path";
-var booleanValue = (values, name, fallback) => {
-  const raw = values.get(name)?.trim().toLowerCase();
-  if (raw === undefined || raw === "")
-    return fallback;
-  if (raw === "true")
-    return true;
-  if (raw === "false")
-    return false;
-  throw new Error(`${name} must be true or false`);
-};
 function readPlatformLaunchEnvironment(path) {
   const absolute2 = resolve12(path);
   const stat2 = lstatSync10(absolute2);
@@ -18632,48 +18597,18 @@ function readPlatformLaunchEnvironment(path) {
       throw new Error(`bootstrap secret environment is missing ${name}`);
     return value;
   };
-  const provider = requiredValue("FZ_EMAIL_PROVIDER");
-  if (provider !== "smtp" && provider !== "jetemail")
-    throw new Error("FZ_EMAIL_PROVIDER must be smtp or jetemail");
-  const smtpPort = provider === "smtp" ? Number(requiredValue("FZ_SMTP_PORT")) : undefined;
-  if (smtpPort !== undefined && (!Number.isInteger(smtpPort) || smtpPort < 1 || smtpPort > 65535)) {
-    throw new Error("FZ_SMTP_PORT must be an integer from 1 through 65535");
-  }
-  const githubEnabled = booleanValue(values, "FZ_GITHUB_ENABLED", false);
-  const githubApp = githubEnabled ? {
-    clientId: requiredValue("FZ_GITHUB_CLIENT_ID"),
-    appId: requiredValue("FZ_GITHUB_APP_ID"),
-    slug: requiredValue("FZ_GITHUB_APP_SLUG")
-  } : undefined;
-  const owner = provider === "jetemail" ? {
-    custodianEmail: requiredValue("FZ_BOOTSTRAP_CUSTODIAN_EMAIL"),
-    email: {
-      provider,
-      from: requiredValue("FZ_EMAIL_FROM"),
-      eu: booleanValue(values, "FZ_JETEMAIL_EU", false)
-    },
-    ...githubApp ? { githubApp } : {}
-  } : {
-    custodianEmail: requiredValue("FZ_BOOTSTRAP_CUSTODIAN_EMAIL"),
-    email: {
-      provider,
-      from: requiredValue("FZ_EMAIL_FROM"),
-      host: requiredValue("FZ_SMTP_HOST"),
-      port: smtpPort,
-      user: requiredValue("FZ_SMTP_USER")
-    },
-    ...githubApp ? { githubApp } : {}
+  const githubOAuth = { clientId: requiredValue("FZ_GITHUB_OAUTH_CLIENT_ID") };
+  const owner = {
+    custodianEmail: "info@axxra.in",
+    email: { provider: "jetemail", from: "noreply@forgezero.net", eu: false },
+    githubOAuth
   };
   return {
     owner,
-    emailSecret: requiredValue(provider === "jetemail" ? "FZ_JETEMAIL_API_KEY" : "FZ_SMTP_PASSWORD"),
+    emailSecret: requiredValue("FZ_JETEMAIL_API_KEY"),
     cloudflareTunnelToken: requiredValue("CF_TUNNEL_TOKEN"),
     cloudflareApiToken: requiredValue("CF_API_TOKEN"),
-    ...githubEnabled ? {
-      githubClientSecret: requiredValue("FZ_GITHUB_CLIENT_SECRET"),
-      githubPrivateKeyBase64: requiredValue("FZ_GITHUB_PRIVATE_KEY_BASE64"),
-      githubWebhookSecret: requiredValue("FZ_GITHUB_WEBHOOK_SECRET")
-    } : {}
+    githubOAuthClientSecret: requiredValue("FZ_GITHUB_OAUTH_CLIENT_SECRET")
   };
 }
 
@@ -19498,11 +19433,7 @@ async function promptPlatformBootstrapSecrets(config, generatedClusterBootstrapC
       cloudflareTunnelToken: await bootstrapSecret("CF_TUNNEL_TOKEN"),
       cloudflareApiToken: await bootstrapSecret("CF_API_TOKEN")
     } : {},
-    ...config.runtime.environment.githubApp ? {
-      githubClientSecret: await bootstrapSecret("GitHub App client secret"),
-      githubPrivateKeyBase64: await bootstrapSecret("GitHub App RSA private key (base64)"),
-      githubWebhookSecret: await bootstrapSecret("GitHub App webhook secret")
-    } : {}
+    githubOAuthClientSecret: await bootstrapSecret("GitHub OAuth client secret")
   });
 }
 var bootstrapList = (question, fallback) => bootstrapAnswer(question, fallback).split(",").map((value) => value.trim()).filter(Boolean);
@@ -19800,34 +19731,11 @@ function selectedForgeZeroLaunchEnvironment(value) {
   return value;
 }
 function forgeZeroLaunchOwnerInput() {
-  const custodianEmail = bootstrapAnswer("First custodian email");
-  const provider = bootstrapAnswer("Bootstrap email provider (smtp/jetemail)", "jetemail");
-  if (provider !== "smtp" && provider !== "jetemail") {
-    throw new Error("Bootstrap email provider must be smtp or jetemail");
-  }
-  const from = bootstrapAnswer("Bootstrap email From address");
-  const githubApp = bootstrapBoolean("Configure the platform GitHub App now?", "no") ? {
-    clientId: bootstrapAnswer("GitHub App client ID"),
-    appId: bootstrapAnswer("GitHub App ID"),
-    slug: bootstrapAnswer("GitHub App slug")
-  } : undefined;
-  if (provider === "jetemail") {
-    return {
-      custodianEmail,
-      email: { provider, from, eu: bootstrapBoolean("Use JetEmail EU processing?", "no") },
-      ...githubApp ? { githubApp } : {}
-    };
-  }
+  const githubOAuth = { clientId: bootstrapAnswer("GitHub OAuth client ID") };
   return {
-    custodianEmail,
-    email: {
-      provider,
-      from,
-      host: bootstrapAnswer("SMTP host"),
-      port: bootstrapNumber("SMTP port", "587"),
-      user: bootstrapAnswer("SMTP user")
-    },
-    ...githubApp ? { githubApp } : {}
+    custodianEmail: "info@axxra.in",
+    email: { provider: "jetemail", from: "noreply@forgezero.net", eu: false },
+    githubOAuth
   };
 }
 async function prepareForgeZeroPlatformLaunch(environment, outputDirectory, projectRoot, owner) {
@@ -19896,6 +19804,7 @@ function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint)
   const backupRegion = backupEndpoint ? bootstrapAnswer("Backup S3 region") : undefined;
   const backupBucket = backupEndpoint ? bootstrapAnswer("Backup S3 bucket") : undefined;
   const backupAccessKeyId = backupEndpoint ? bootstrapAnswer("Backup S3 access-key id") : undefined;
+  const githubOAuthClientId = bootstrapAnswer("GitHub OAuth client ID");
   const cloudflareHandoffFile = genesis ? cloudflareHostHandoffPath(genesisCloudflareCheckpoint, computeReference) : bootstrapAnswer("Node-specific Cloudflare host handoff (blank for no public edge)", "");
   const cloudflareNodeName = cloudflareHandoffFile ? genesis ? computeReference : bootstrapAnswer("Cloudflare handoff node name", computeReference) : undefined;
   const databaseNetworkMode = "private-lan";
@@ -19950,6 +19859,7 @@ function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint)
         otlpTraceSampleRatio: 0.1,
         custodianEmail: role === "master" ? bootstrapAnswer("First custodian email") : undefined,
         email: emailProvider === "smtp" ? { provider: "smtp", host: smtpHost, port: smtpPort, user: smtpUser, from: emailFrom } : { provider: "jetemail", from: emailFrom, eu: jetemailEu },
+        githubOAuth: { clientId: githubOAuthClientId },
         ...backupEndpoint && backupRegion && backupBucket && backupAccessKeyId ? {
           backup: { endpoint: backupEndpoint, region: backupRegion, bucket: backupBucket, accessKeyId: backupAccessKeyId }
         } : {},
@@ -20010,11 +19920,7 @@ async function runAttendedPlatformFleet(fleet, apply, generatedClusterBootstrapC
     emailSecret: environmentInput.emailSecret,
     cloudflareTunnelToken: environmentInput.cloudflareTunnelToken,
     cloudflareApiToken: environmentInput.cloudflareApiToken,
-    ...environmentInput.githubClientSecret ? {
-      githubClientSecret: environmentInput.githubClientSecret,
-      githubPrivateKeyBase64: environmentInput.githubPrivateKeyBase64,
-      githubWebhookSecret: environmentInput.githubWebhookSecret
-    } : {}
+    githubOAuthClientSecret: environmentInput.githubOAuthClientSecret
   }) : await promptPlatformBootstrapSecrets(firstConfig, generatedClusterBootstrapCode);
   const cloudflare = await resolveCloudflareBootstrapCommandConfig(fleet.cloudflareConfigFile, {
     tunnelToken: secrets.cloudflareTunnelToken,

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.107";
+var VERSION = "0.1.108";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.js

@@ -1426,7 +1426,7 @@ async function refreshBootstrapBundle(input, exec = run) {
 }
 
 // src/bootstrap.ts
-import { createHash as createHash2, createHmac as createHmac2, createPrivateKey, randomBytes as randomBytes3 } from "crypto";
+import { createHash as createHash2, createHmac as createHmac2, randomBytes as randomBytes3 } from "crypto";
 import {
   chmodSync as chmodSync3,
   existsSync as existsSync5,
@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.107";
+var VERSION = "0.1.108";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3228,10 +3228,8 @@ function validatePlatformSharedEnvironment(input) {
   } else if (input.email !== undefined) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
-  if (input.githubApp) {
-    if (!/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubApp.clientId) || !/^[1-9][0-9]{0,19}$/.test(input.githubApp.appId) || !/^[a-z0-9][a-z0-9-]{0,99}$/.test(input.githubApp.slug)) {
-      throw new Error("GitHub App client id, app id or slug is malformed.");
-    }
+  if (!input.githubOAuth || !/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubOAuth.clientId)) {
+    throw new Error("GitHub OAuth client id is malformed.");
   }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
   if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
@@ -3363,9 +3361,7 @@ function renderPlatformSharedEnvironment(input) {
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
     FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
-    FZ_GITHUB_CLIENT_ID: value.githubApp?.clientId ?? "",
-    FZ_GITHUB_APP_ID: value.githubApp?.appId ?? "",
-    FZ_GITHUB_APP_SLUG: value.githubApp?.slug ?? "",
+    FZ_GITHUB_OAUTH_CLIENT_ID: value.githubOAuth.clientId,
     FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
@@ -3377,9 +3373,7 @@ function platformApiCredentialSpecs(options) {
   const optional = [
     ["fz_smtp.password", options.emailProvider === "smtp"],
     ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
-    ["fz_github.clientSecret", options.githubApp],
-    ["fz_github.privateKey", options.githubApp],
-    ["fz_github.webhookSecret", options.githubApp],
+    ["fz_oauth.github.clientSecret", options.githubOAuth],
     ["CF_API_TOKEN", options.cloudflareKv],
     ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],
@@ -3783,9 +3777,7 @@ function validatePlatformBootstrapSecrets(config, input) {
     "backupS3Secret",
     "cloudflareTunnelToken",
     "cloudflareApiToken",
-    "githubClientSecret",
-    "githubPrivateKeyBase64",
-    "githubWebhookSecret"
+    "githubOAuthClientSecret"
   ];
   const unknown = Object.keys(source).filter((key) => !allowed.includes(key));
   if (unknown.length)
@@ -3796,9 +3788,7 @@ function validatePlatformBootstrapSecrets(config, input) {
   const backupS3Secret = typeof source.backupS3Secret === "string" ? source.backupS3Secret.trim() : undefined;
   const cloudflareTunnelToken = typeof source.cloudflareTunnelToken === "string" ? source.cloudflareTunnelToken.trim() : undefined;
   const cloudflareApiToken = typeof source.cloudflareApiToken === "string" ? source.cloudflareApiToken.trim() : undefined;
-  const githubClientSecret = typeof source.githubClientSecret === "string" ? source.githubClientSecret.trim() : undefined;
-  const githubPrivateKeyBase64 = typeof source.githubPrivateKeyBase64 === "string" ? source.githubPrivateKeyBase64.trim() : undefined;
-  const githubWebhookSecret = typeof source.githubWebhookSecret === "string" ? source.githubWebhookSecret.trim() : undefined;
+  const githubOAuthClientSecret = typeof source.githubOAuthClientSecret === "string" ? source.githubOAuthClientSecret.trim() : "";
   if (!/^[a-f0-9]{64}$/i.test(clusterBootstrapCode))
     throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
   if (!emailSecret || emailSecret.length > 16384 || /[\r\n\0]/.test(emailSecret))
@@ -3818,21 +3808,8 @@ function validatePlatformBootstrapSecrets(config, input) {
   }
   if (cloudflareTunnelToken)
     validateCloudflareBootstrapSecretPair({ cloudflareTunnelToken, cloudflareApiToken });
-  const githubConfigured = Boolean(config.runtime.environment.githubApp);
-  if (githubConfigured !== Boolean(githubClientSecret && githubPrivateKeyBase64 && githubWebhookSecret)) {
-    throw new Error("GitHub App coordinates require client secret, private key and webhook secret together");
-  }
-  if (githubConfigured) {
-    if (githubClientSecret.length < 20 || githubClientSecret.length > 512 || /[\r\n\0]/.test(githubClientSecret) || githubWebhookSecret.length < 32 || githubWebhookSecret.length > 512 || /[\r\n\0]/.test(githubWebhookSecret)) {
-      throw new Error("GitHub App client or webhook secret is malformed");
-    }
-    try {
-      const pem = Buffer.from(githubPrivateKeyBase64, "base64").toString("utf8");
-      if (createPrivateKey(pem).asymmetricKeyType !== "rsa")
-        throw new Error("not RSA");
-    } catch {
-      throw new Error("GitHub App private key must be a base64-encoded RSA private key");
-    }
+  if (githubOAuthClientSecret.length < 20 || githubOAuthClientSecret.length > 512 || /[\r\n\0]/.test(githubOAuthClientSecret)) {
+    throw new Error("GitHub OAuth client secret is malformed");
   }
   return {
     clusterBootstrapCode,
@@ -3840,7 +3817,7 @@ function validatePlatformBootstrapSecrets(config, input) {
     ...enrolmentToken ? { enrolmentToken } : {},
     ...backupS3Secret ? { backupS3Secret } : {},
     ...cloudflareTunnelToken ? { cloudflareTunnelToken, cloudflareApiToken } : {},
-    ...githubConfigured ? { githubClientSecret, githubPrivateKeyBase64, githubWebhookSecret } : {}
+    githubOAuthClientSecret
   };
 }
 var platformBootstrapRunner = (config) => config.kind === "platform" && config.database.role === "master";
@@ -4764,9 +4741,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       backup: checked4.backupS3Secret,
       cloudflareTunnelToken: checked4.cloudflareTunnelToken,
       cloudflareApiToken: checked4.cloudflareApiToken,
-      githubClientSecret: checked4.githubClientSecret,
-      githubPrivateKey: checked4.githubPrivateKeyBase64 ? Buffer.from(checked4.githubPrivateKeyBase64, "base64").toString("utf8") : undefined,
-      githubWebhookSecret: checked4.githubWebhookSecret
+      githubOAuthClientSecret: checked4.githubOAuthClientSecret
     };
   })() : undefined;
   const enrolledPrivate = config.kind === "enrolled-compute" ? validateEnrolledComputeBootstrapSecrets(config, secrets) : undefined;
@@ -4867,9 +4842,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "fz_smtp.password" : config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : undefined;
     for (const [name, source] of Object.entries({
       ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
-      "fz_github.clientSecret": platformPrivate.githubClientSecret,
-      "fz_github.privateKey": platformPrivate.githubPrivateKey,
-      "fz_github.webhookSecret": platformPrivate.githubWebhookSecret,
+      "fz_oauth.github.clientSecret": platformPrivate.githubOAuthClientSecret,
       "backup.s3.secretAccessKey": platformPrivate.backup
     })) {
       if (source) {
@@ -4886,7 +4859,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const credentials = platformApiCredentialSpecs({
       emailProvider: runtime.environment.email?.provider,
       cloudflareKv: cloudflareConfigured,
-      githubApp: Boolean(runtime.environment.githubApp),
+      githubOAuth: true,
       realtime: Boolean(runtime.environment.realtime)
     });
     const units = renderPlatformApiUnits({
@@ -5134,6 +5107,7 @@ function strictBootstrapDocument(value) {
       "agentOtlpEndpoint",
       "custodianEmail",
       "email",
+      "githubOAuth",
       "deployProfile",
       "otlpFlushIntervalMs",
       "otlpTraceSampleRatio",
@@ -5144,6 +5118,7 @@ function strictBootstrapDocument(value) {
       "databaseReadPreferredCoordinators"
     ], "runtime environment");
     const environment = runtime.environment;
+    exactKeys(environment.githubOAuth, ["clientId"], "GitHub OAuth config");
     if (environment.initialInventory !== undefined) {
       const inventory = exactKeys(environment.initialInventory, ["metalHostname", "metalIdentity", "region", "computes", "attestation", "deployment"], "initial inventory");
       if (inventory.metalIdentity !== undefined) {

package/dist/platform-bootstrap-runtime.d.ts

@@ -73,10 +73,8 @@ export type PlatformBootstrapEmail = {
  * webhook secret are attended inputs sealed as systemd credentials and later
  * imported into the unlocked platform Vault.
  */
-export interface PlatformBootstrapGitHubApp {
+export interface PlatformBootstrapGitHubOAuth {
     clientId: string;
-    appId: string;
-    slug: string;
 }
 export interface PlatformSharedEnvironment {
     softwareProfile: PlatformSoftwareProfile;
@@ -109,7 +107,7 @@ export interface PlatformSharedEnvironment {
     otlpTraceSampleRatio: number;
     custodianEmail?: string;
     email?: PlatformBootstrapEmail;
-    githubApp?: PlatformBootstrapGitHubApp;
+    githubOAuth: PlatformBootstrapGitHubOAuth;
     backup?: {
         endpoint: string;
         region: string;
@@ -137,13 +135,13 @@ export declare function validatePlatformSharedEnvironment(input: PlatformSharedE
 /** Render only non-secret runtime coordinates. Passwords/tokens have no field in this contract. */
 export declare function renderPlatformSharedEnvironment(input: PlatformSharedEnvironment): string;
 export interface SystemdCredentialSpec {
-    name: 'arangodb-jwt' | 'arangodb-root-password' | 'seed-sync-root' | 'fz_smtp.password' | 'fz_jetemail.apiKey' | 'fz_github.clientSecret' | 'fz_github.privateKey' | 'fz_github.webhookSecret' | 'CF_API_TOKEN' | 'CF_TUNNEL_TOKEN' | 'REALTIME_PUBLISH_SECRET' | 'REALTIME_TICKET_SECRET';
+    name: 'arangodb-jwt' | 'arangodb-root-password' | 'seed-sync-root' | 'fz_smtp.password' | 'fz_jetemail.apiKey' | 'fz_oauth.github.clientSecret' | 'CF_API_TOKEN' | 'CF_TUNNEL_TOKEN' | 'REALTIME_PUBLISH_SECRET' | 'REALTIME_TICKET_SECRET';
     encryptedPath: string;
     required: boolean;
 }
 export declare function platformApiCredentialSpecs(options: {
     emailProvider?: PlatformBootstrapEmail['provider'];
-    githubApp: boolean;
+    githubOAuth: boolean;
     cloudflareKv: boolean;
     realtime: boolean;
 }): SystemdCredentialSpec[];

package/dist/platform-bootstrap-runtime.js

@@ -828,10 +828,8 @@ function validatePlatformSharedEnvironment(input) {
   } else if (input.email !== undefined) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
-  if (input.githubApp) {
-    if (!/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubApp.clientId) || !/^[1-9][0-9]{0,19}$/.test(input.githubApp.appId) || !/^[a-z0-9][a-z0-9-]{0,99}$/.test(input.githubApp.slug)) {
-      throw new Error("GitHub App client id, app id or slug is malformed.");
-    }
+  if (!input.githubOAuth || !/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubOAuth.clientId)) {
+    throw new Error("GitHub OAuth client id is malformed.");
   }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
   if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
@@ -963,9 +961,7 @@ function renderPlatformSharedEnvironment(input) {
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
     FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
-    FZ_GITHUB_CLIENT_ID: value.githubApp?.clientId ?? "",
-    FZ_GITHUB_APP_ID: value.githubApp?.appId ?? "",
-    FZ_GITHUB_APP_SLUG: value.githubApp?.slug ?? "",
+    FZ_GITHUB_OAUTH_CLIENT_ID: value.githubOAuth.clientId,
     FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
@@ -977,9 +973,7 @@ function platformApiCredentialSpecs(options) {
   const optional = [
     ["fz_smtp.password", options.emailProvider === "smtp"],
     ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
-    ["fz_github.clientSecret", options.githubApp],
-    ["fz_github.privateKey", options.githubApp],
-    ["fz_github.webhookSecret", options.githubApp],
+    ["fz_oauth.github.clientSecret", options.githubOAuth],
     ["CF_API_TOKEN", options.cloudflareKv],
     ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],

package/dist/platform-fleet-verification.js

@@ -3004,7 +3004,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.107";
+var VERSION3 = "0.1.108";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -4336,10 +4336,8 @@ function validatePlatformSharedEnvironment(input) {
   } else if (input.email !== undefined) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
-  if (input.githubApp) {
-    if (!/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubApp.clientId) || !/^[1-9][0-9]{0,19}$/.test(input.githubApp.appId) || !/^[a-z0-9][a-z0-9-]{0,99}$/.test(input.githubApp.slug)) {
-      throw new Error("GitHub App client id, app id or slug is malformed.");
-    }
+  if (!input.githubOAuth || !/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubOAuth.clientId)) {
+    throw new Error("GitHub OAuth client id is malformed.");
   }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
   if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
@@ -4471,9 +4469,7 @@ function renderPlatformSharedEnvironment(input) {
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
     FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
-    FZ_GITHUB_CLIENT_ID: value.githubApp?.clientId ?? "",
-    FZ_GITHUB_APP_ID: value.githubApp?.appId ?? "",
-    FZ_GITHUB_APP_SLUG: value.githubApp?.slug ?? "",
+    FZ_GITHUB_OAUTH_CLIENT_ID: value.githubOAuth.clientId,
     FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
@@ -4485,9 +4481,7 @@ function platformApiCredentialSpecs(options) {
   const optional = [
     ["fz_smtp.password", options.emailProvider === "smtp"],
     ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
-    ["fz_github.clientSecret", options.githubApp],
-    ["fz_github.privateKey", options.githubApp],
-    ["fz_github.webhookSecret", options.githubApp],
+    ["fz_oauth.github.clientSecret", options.githubOAuth],
     ["CF_API_TOKEN", options.cloudflareKv],
     ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],
@@ -4842,7 +4836,7 @@ function planLocalOtlpProof(endpoint, collectorUnit) {
 import { lstatSync as lstatSync5 } from "node:fs";
 
 // src/bootstrap.ts
-import { createHash as createHash7, createHmac as createHmac2, createPrivateKey, randomBytes as randomBytes3 } from "node:crypto";
+import { createHash as createHash7, createHmac as createHmac2, randomBytes as randomBytes3 } from "node:crypto";
 import {
   chmodSync as chmodSync9,
   existsSync as existsSync11,

package/dist/platform-launch-env.d.ts

@@ -4,9 +4,7 @@ export interface PlatformLaunchEnvironmentInput {
     emailSecret: string;
     cloudflareTunnelToken: string;
     cloudflareApiToken: string;
-    githubClientSecret?: string;
-    githubPrivateKeyBase64?: string;
-    githubWebhookSecret?: string;
+    githubOAuthClientSecret: string;
 }
 /**
  * Read the development-only attended-launch adapter.

package/dist/platform-launch-profile.d.ts

@@ -45,10 +45,9 @@ export interface ForgeZeroLaunchOwnerInput {
         from: string;
         eu: boolean;
     };
-    githubApp?: {
+    /** Required bootstrap identity provider. Repository automation is configured after genesis. */
+    githubOAuth: {
         clientId: string;
-        appId: string;
-        slug: string;
     };
 }
 /**

package/dist/provision.js

@@ -3004,7 +3004,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.107";
+var VERSION3 = "0.1.108";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.107";
+export declare const VERSION = "0.1.108";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.107",
+  "version": "0.1.108",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",