@forgezero/agent 0.1.115 → 0.1.117

package/README.md

@@ -229,8 +229,8 @@ import {
   ForgeZero,
 } from '@forgezero/vault';
 
-const fz = new ForgeZero({ project: 'altpilot', environment: 'production' });
-await fz.get('STRIPE_KEY');
+const fz = new ForgeZero({ project: 'payments-api', environment: 'production' });
+await fz.get('PAYMENT_PROVIDER');
 ```
 
 ## A local copy, not a cache

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.115";
+var VERSION3 = "0.1.117";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.d.ts

@@ -89,7 +89,7 @@ export interface EnrolledComputeActivationConfig {
     profile?: string;
     deployRoot?: string;
     software?: SoftwareRequirement[];
-    /** Compatibility-only per-node SSH deploy key. GitHub App is the scalable default. */
+    /** Compatibility-only per-node SSH deploy key for non-provider sources. */
     gitDeployKey?: boolean;
     installCloudflared?: boolean;
     installWarp?: boolean;
@@ -115,7 +115,6 @@ export interface PlatformBootstrapSecrets {
     backupS3Secret?: string;
     cloudflareTunnelToken?: string;
     cloudflareApiToken?: string;
-    githubOAuthClientSecret: string;
 }
 export interface EnrolledComputeBootstrapSecrets {
     enrolmentToken: string;

package/dist/bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.115";
+var VERSION = "0.1.117";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3127,6 +3127,9 @@ function platformGenesisClaims(guests, sshPublicKeys) {
     throw new Error("platform genesis requires at least one operator SSH public key");
   return reviewed.map((guest) => claimFor(guest, keys, "create"));
 }
+function platformGenesisDeletionClaims(guests) {
+  return validatePlatformGenesisGuests(guests).map((guest) => claimFor(guest, [], "delete"));
+}
 function platformCommunityRehearsalClaims(seedGuests, rehearsalGuest, sshPublicKeys) {
   const reviewed = validatePlatformGenesisGuests([...seedGuests, rehearsalGuest], 4);
   const keys = [...new Set(sshPublicKeys.map(publicKey))];
@@ -3269,9 +3272,6 @@ function validatePlatformSharedEnvironment(input) {
   } else if (input.email !== undefined) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
-  if (!input.githubOAuth || !/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubOAuth.clientId)) {
-    throw new Error("GitHub OAuth client id is malformed.");
-  }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
   if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
     throw new Error("seedSyncMembers must contain 3 to 64 unique physical host identities.");
@@ -3402,7 +3402,6 @@ function renderPlatformSharedEnvironment(input) {
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
     FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
-    FZ_GITHUB_OAUTH_CLIENT_ID: value.githubOAuth.clientId,
     FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
@@ -3414,7 +3413,6 @@ function platformApiCredentialSpecs(options) {
   const optional = [
     ["fz_smtp.password", options.emailProvider === "smtp"],
     ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
-    ["fz_oauth.github.clientSecret", options.githubOAuth],
     ["CF_API_TOKEN", options.cloudflareKv],
     ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],
@@ -3811,15 +3809,7 @@ function validatePlatformBootstrapSecrets(config, input) {
   if (!input || typeof input !== "object" || Array.isArray(input))
     throw new Error("bootstrap credential input must be an object");
   const source = input;
-  const allowed = [
-    "clusterBootstrapCode",
-    "emailSecret",
-    "enrolmentToken",
-    "backupS3Secret",
-    "cloudflareTunnelToken",
-    "cloudflareApiToken",
-    "githubOAuthClientSecret"
-  ];
+  const allowed = ["clusterBootstrapCode", "emailSecret", "enrolmentToken", "backupS3Secret", "cloudflareTunnelToken", "cloudflareApiToken"];
   const unknown = Object.keys(source).filter((key) => !allowed.includes(key));
   if (unknown.length)
     throw new Error(`bootstrap credential input contains unsupported field ${unknown[0]}`);
@@ -3829,7 +3819,6 @@ function validatePlatformBootstrapSecrets(config, input) {
   const backupS3Secret = typeof source.backupS3Secret === "string" ? source.backupS3Secret.trim() : undefined;
   const cloudflareTunnelToken = typeof source.cloudflareTunnelToken === "string" ? source.cloudflareTunnelToken.trim() : undefined;
   const cloudflareApiToken = typeof source.cloudflareApiToken === "string" ? source.cloudflareApiToken.trim() : undefined;
-  const githubOAuthClientSecret = typeof source.githubOAuthClientSecret === "string" ? source.githubOAuthClientSecret.trim() : "";
   if (!/^[a-f0-9]{64}$/i.test(clusterBootstrapCode))
     throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
   if (!emailSecret || emailSecret.length > 16384 || /[\r\n\0]/.test(emailSecret))
@@ -3849,16 +3838,12 @@ function validatePlatformBootstrapSecrets(config, input) {
   }
   if (cloudflareTunnelToken)
     validateCloudflareBootstrapSecretPair({ cloudflareTunnelToken, cloudflareApiToken });
-  if (githubOAuthClientSecret.length < 20 || githubOAuthClientSecret.length > 512 || /[\r\n\0]/.test(githubOAuthClientSecret)) {
-    throw new Error("GitHub OAuth client secret is malformed");
-  }
   return {
     clusterBootstrapCode,
     emailSecret,
     ...enrolmentToken ? { enrolmentToken } : {},
     ...backupS3Secret ? { backupS3Secret } : {},
-    ...cloudflareTunnelToken ? { cloudflareTunnelToken, cloudflareApiToken } : {},
-    githubOAuthClientSecret
+    ...cloudflareTunnelToken ? { cloudflareTunnelToken, cloudflareApiToken } : {}
   };
 }
 var platformBootstrapRunner = (config) => config.kind === "platform" && config.database.role === "master";
@@ -4781,8 +4766,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       enrolmentToken: checked4.enrolmentToken,
       backup: checked4.backupS3Secret,
       cloudflareTunnelToken: checked4.cloudflareTunnelToken,
-      cloudflareApiToken: checked4.cloudflareApiToken,
-      githubOAuthClientSecret: checked4.githubOAuthClientSecret
+      cloudflareApiToken: checked4.cloudflareApiToken
     };
   })() : undefined;
   const enrolledPrivate = config.kind === "enrolled-compute" ? validateEnrolledComputeBootstrapSecrets(config, secrets) : undefined;
@@ -4883,7 +4867,6 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "fz_smtp.password" : config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : undefined;
     for (const [name, source] of Object.entries({
       ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
-      "fz_oauth.github.clientSecret": platformPrivate.githubOAuthClientSecret,
       "backup.s3.secretAccessKey": platformPrivate.backup
     })) {
       if (source) {
@@ -4900,7 +4883,6 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const credentials = platformApiCredentialSpecs({
       emailProvider: runtime.environment.email?.provider,
       cloudflareKv: cloudflareConfigured,
-      githubOAuth: true,
       realtime: Boolean(runtime.environment.realtime)
     });
     const units = renderPlatformApiUnits({
@@ -5148,7 +5130,6 @@ function strictBootstrapDocument(value) {
       "agentOtlpEndpoint",
       "custodianEmail",
       "email",
-      "githubOAuth",
       "deployProfile",
       "otlpFlushIntervalMs",
       "otlpTraceSampleRatio",
@@ -5159,7 +5140,6 @@ function strictBootstrapDocument(value) {
       "databaseReadPreferredCoordinators"
     ], "runtime environment");
     const environment = runtime.environment;
-    exactKeys(environment.githubOAuth, ["clientId"], "GitHub OAuth config");
     if (environment.initialInventory !== undefined) {
       const inventory = exactKeys(environment.initialInventory, ["metalHostname", "metalIdentity", "region", "computes", "attestation", "deployment"], "initial inventory");
       if (inventory.metalIdentity !== undefined) {

package/dist/fz-agent.js

@@ -9601,7 +9601,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.115";
+var VERSION2 = "0.1.117";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4634,7 +4634,7 @@ var VaultError, runtimeEnvironment = () => typeof process !== "undefined" && pro
   } catch {
     return;
   }
-}, VERSION = "0.1.20";
+}, VERSION = "0.1.21";
 var init_dist = __esm(() => {
   init_identity();
   VaultError = class VaultError extends Error {
@@ -4841,7 +4841,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.115";
+var VERSION2 = "0.1.117";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -12238,6 +12238,9 @@ function platformGenesisClaims(guests, sshPublicKeys) {
     throw new Error("platform genesis requires at least one operator SSH public key");
   return reviewed.map((guest) => claimFor(guest, keys, "create"));
 }
+function platformGenesisDeletionClaims(guests) {
+  return validatePlatformGenesisGuests(guests).map((guest) => claimFor(guest, [], "delete"));
+}
 function platformCommunityRehearsalClaims(seedGuests, rehearsalGuest, sshPublicKeys) {
   const reviewed = validatePlatformGenesisGuests([...seedGuests, rehearsalGuest], 4);
   const keys = [...new Set(sshPublicKeys.map(publicKey))];
@@ -12380,9 +12383,6 @@ function validatePlatformSharedEnvironment(input) {
   } else if (input.email !== undefined) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
-  if (!input.githubOAuth || !/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubOAuth.clientId)) {
-    throw new Error("GitHub OAuth client id is malformed.");
-  }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
   if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
     throw new Error("seedSyncMembers must contain 3 to 64 unique physical host identities.");
@@ -12513,7 +12513,6 @@ function renderPlatformSharedEnvironment(input) {
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
     FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
-    FZ_GITHUB_OAUTH_CLIENT_ID: value.githubOAuth.clientId,
     FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
@@ -12525,7 +12524,6 @@ function platformApiCredentialSpecs(options) {
   const optional = [
     ["fz_smtp.password", options.emailProvider === "smtp"],
     ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
-    ["fz_oauth.github.clientSecret", options.githubOAuth],
     ["CF_API_TOKEN", options.cloudflareKv],
     ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],
@@ -14198,15 +14196,7 @@ function validatePlatformBootstrapSecrets(config, input) {
   if (!input || typeof input !== "object" || Array.isArray(input))
     throw new Error("bootstrap credential input must be an object");
   const source = input;
-  const allowed = [
-    "clusterBootstrapCode",
-    "emailSecret",
-    "enrolmentToken",
-    "backupS3Secret",
-    "cloudflareTunnelToken",
-    "cloudflareApiToken",
-    "githubOAuthClientSecret"
-  ];
+  const allowed = ["clusterBootstrapCode", "emailSecret", "enrolmentToken", "backupS3Secret", "cloudflareTunnelToken", "cloudflareApiToken"];
   const unknown = Object.keys(source).filter((key) => !allowed.includes(key));
   if (unknown.length)
     throw new Error(`bootstrap credential input contains unsupported field ${unknown[0]}`);
@@ -14216,7 +14206,6 @@ function validatePlatformBootstrapSecrets(config, input) {
   const backupS3Secret = typeof source.backupS3Secret === "string" ? source.backupS3Secret.trim() : undefined;
   const cloudflareTunnelToken = typeof source.cloudflareTunnelToken === "string" ? source.cloudflareTunnelToken.trim() : undefined;
   const cloudflareApiToken = typeof source.cloudflareApiToken === "string" ? source.cloudflareApiToken.trim() : undefined;
-  const githubOAuthClientSecret = typeof source.githubOAuthClientSecret === "string" ? source.githubOAuthClientSecret.trim() : "";
   if (!/^[a-f0-9]{64}$/i.test(clusterBootstrapCode))
     throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
   if (!emailSecret || emailSecret.length > 16384 || /[\r\n\0]/.test(emailSecret))
@@ -14236,16 +14225,12 @@ function validatePlatformBootstrapSecrets(config, input) {
   }
   if (cloudflareTunnelToken)
     validateCloudflareBootstrapSecretPair({ cloudflareTunnelToken, cloudflareApiToken });
-  if (githubOAuthClientSecret.length < 20 || githubOAuthClientSecret.length > 512 || /[\r\n\0]/.test(githubOAuthClientSecret)) {
-    throw new Error("GitHub OAuth client secret is malformed");
-  }
   return {
     clusterBootstrapCode,
     emailSecret,
     ...enrolmentToken ? { enrolmentToken } : {},
     ...backupS3Secret ? { backupS3Secret } : {},
-    ...cloudflareTunnelToken ? { cloudflareTunnelToken, cloudflareApiToken } : {},
-    githubOAuthClientSecret
+    ...cloudflareTunnelToken ? { cloudflareTunnelToken, cloudflareApiToken } : {}
   };
 }
 var platformBootstrapRunner = (config) => config.kind === "platform" && config.database.role === "master";
@@ -15168,8 +15153,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       enrolmentToken: checked4.enrolmentToken,
       backup: checked4.backupS3Secret,
       cloudflareTunnelToken: checked4.cloudflareTunnelToken,
-      cloudflareApiToken: checked4.cloudflareApiToken,
-      githubOAuthClientSecret: checked4.githubOAuthClientSecret
+      cloudflareApiToken: checked4.cloudflareApiToken
     };
   })() : undefined;
   const enrolledPrivate = config.kind === "enrolled-compute" ? validateEnrolledComputeBootstrapSecrets(config, secrets) : undefined;
@@ -15270,7 +15254,6 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "fz_smtp.password" : config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : undefined;
     for (const [name, source] of Object.entries({
       ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
-      "fz_oauth.github.clientSecret": platformPrivate.githubOAuthClientSecret,
       "backup.s3.secretAccessKey": platformPrivate.backup
     })) {
       if (source) {
@@ -15287,7 +15270,6 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const credentials = platformApiCredentialSpecs({
       emailProvider: runtime.environment.email?.provider,
       cloudflareKv: cloudflareConfigured,
-      githubOAuth: true,
       realtime: Boolean(runtime.environment.realtime)
     });
     const units = renderPlatformApiUnits({
@@ -15535,7 +15517,6 @@ function strictBootstrapDocument(value) {
       "agentOtlpEndpoint",
       "custodianEmail",
       "email",
-      "githubOAuth",
       "deployProfile",
       "otlpFlushIntervalMs",
       "otlpTraceSampleRatio",
@@ -15546,7 +15527,6 @@ function strictBootstrapDocument(value) {
       "databaseReadPreferredCoordinators"
     ], "runtime environment");
     const environment = runtime.environment;
-    exactKeys2(environment.githubOAuth, ["clientId"], "GitHub OAuth config");
     if (environment.initialInventory !== undefined) {
       const inventory = exactKeys2(environment.initialInventory, ["metalHostname", "metalIdentity", "region", "computes", "attestation", "deployment"], "initial inventory");
       if (inventory.metalIdentity !== undefined) {
@@ -17363,14 +17343,14 @@ function planOperatorMetalBootstrap(request, mode) {
   if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && !request.genesis.rehearsalNode) {
     throw new Error("the reviewed metal request has no rehearsal node");
   }
-  const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
+  const claims = mode === "genesis-cleanup" ? platformGenesisDeletionClaims(request.genesis.nodes) : mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
   const genesisNodes = mode === "host-keys" ? request.genesis.nodes.map(({ name }) => name) : mode === "rehearsal-host-keys" ? guestRows(request).map(({ name }) => name) : claims.map((claim) => claim.spec.guestName).filter((name) => Boolean(name));
   return {
     kind: "metal-remote",
     mode,
     mutation: !["status", "host-keys", "rehearsal-host-keys"].includes(mode),
     target: { address: request.target.address, port: request.target.port, user: request.target.user },
-    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "host-keys" || mode === "rehearsal-host-keys" ? ["verify pinned SSH transport", "collect exact Ed25519 host keys for the reviewed guest addresses"] : mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the three reviewed seed claims plus the reviewed fourth Community rehearsal claim to the constrained Metal helper" : mode === "rehearsal-cleanup" ? "delete the exact four reviewed disposable guests and their owned disks, units, seed data and inventory" : "send the three reviewed platform-genesis claims to the constrained Metal helper"] : [
+    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "host-keys" || mode === "rehearsal-host-keys" ? ["verify pinned SSH transport", "collect exact Ed25519 host keys for the reviewed guest addresses"] : mode === "genesis" || mode === "genesis-cleanup" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the three reviewed seed claims plus the reviewed fourth Community rehearsal claim to the constrained Metal helper" : mode === "genesis-cleanup" ? "delete the exact three reviewed platform guests and their owned disks, units, seed data and inventory" : mode === "rehearsal-cleanup" ? "delete the exact four reviewed disposable guests and their owned disks, units, seed data and inventory" : "send the three reviewed platform-genesis claims to the constrained Metal helper"] : [
       "verify pinned SSH transport and caller-approved SSH agent",
       "copy pinned Bun and packaged fz artifacts to private staging",
       "stage the strict owner-only metal config and optional seed handoff",
@@ -17968,13 +17948,13 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
         output: JSON.stringify(await collectOperatorGuestHostKeys(request, { ...options, exec }, mode === "rehearsal-host-keys"))
       };
     }
-    if (mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup") {
+    if (mode === "genesis" || mode === "genesis-cleanup" || mode === "rehearsal" || mode === "rehearsal-cleanup") {
       const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
       if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && !request.genesis.rehearsalNode) {
         throw new Error("the reviewed metal request has no rehearsal node");
       }
       const outputs = [];
-      const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
+      const claims = mode === "genesis-cleanup" ? platformGenesisDeletionClaims(request.genesis.nodes) : mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
       for (const claim of claims) {
         outputs.push(await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz-agent", "metal-apply", "--claim=-"], `provision ${claim.spec.guestName}`, false, `${JSON.stringify(claim)}
 `));
@@ -18260,7 +18240,6 @@ function forgeZeroLaunchTemplate(profile, guests, bundle, owner) {
         otlpTraceSampleRatio: 0.1,
         custodianEmail: owner.custodianEmail,
         email: owner.email,
-        githubOAuth: owner.githubOAuth,
         deployProfile: profile.environment
       },
       serviceUser: "forgezero-api",
@@ -18648,18 +18627,15 @@ function readPlatformLaunchEnvironment(path) {
       throw new Error(`bootstrap secret environment is missing ${name}`);
     return value;
   };
-  const githubOAuth = { clientId: requiredValue("FZ_GITHUB_OAUTH_CLIENT_ID") };
   const owner = {
     custodianEmail: "info@axxra.in",
-    email: { provider: "jetemail", from: "noreply@forgezero.net", eu: false },
-    githubOAuth
+    email: { provider: "jetemail", from: "noreply@forgezero.net", eu: false }
   };
   return {
     owner,
     emailSecret: requiredValue("FZ_JETEMAIL_API_KEY"),
     cloudflareTunnelToken: requiredValue("CF_TUNNEL_TOKEN"),
-    cloudflareApiToken: requiredValue("CF_API_TOKEN"),
-    githubOAuthClientSecret: requiredValue("FZ_GITHUB_OAUTH_CLIENT_SECRET")
+    cloudflareApiToken: requiredValue("CF_API_TOKEN")
   };
 }
 
@@ -18878,7 +18854,9 @@ function parseOptions(argv2) {
       options.bootstrapConfigPath = argv2[++index];
     else if (token === "--secrets-env-file")
       options.bootstrapSecretsEnvFile = argv2[++index];
-    else if (token === "--output")
+    else if (token.startsWith("--confirm-disposable-fleet=")) {
+      options.disposableFleetConfirmation = token.slice("--confirm-disposable-fleet=".length);
+    } else if (token === "--output")
       options.outputPath = argv2[++index];
     else if (token === "--query")
       options.queries.push(argv2[++index] ?? "");
@@ -19483,8 +19461,7 @@ async function promptPlatformBootstrapSecrets(config, generatedClusterBootstrapC
     ...config.cloudflareHandoff || config.runtime.environment.cloudflare ? {
       cloudflareTunnelToken: await bootstrapSecret("CF_TUNNEL_TOKEN"),
       cloudflareApiToken: await bootstrapSecret("CF_API_TOKEN")
-    } : {},
-    githubOAuthClientSecret: await bootstrapSecret("GitHub OAuth client secret")
+    } : {}
   });
 }
 var bootstrapList = (question, fallback) => bootstrapAnswer(question, fallback).split(",").map((value) => value.trim()).filter(Boolean);
@@ -19782,11 +19759,9 @@ function selectedForgeZeroLaunchEnvironment(value) {
   return value;
 }
 function forgeZeroLaunchOwnerInput() {
-  const githubOAuth = { clientId: bootstrapAnswer("GitHub OAuth client ID") };
   return {
     custodianEmail: "info@axxra.in",
-    email: { provider: "jetemail", from: "noreply@forgezero.net", eu: false },
-    githubOAuth
+    email: { provider: "jetemail", from: "noreply@forgezero.net", eu: false }
   };
 }
 async function prepareForgeZeroPlatformLaunch(environment, outputDirectory, projectRoot, owner) {
@@ -19855,7 +19830,6 @@ function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint)
   const backupRegion = backupEndpoint ? bootstrapAnswer("Backup S3 region") : undefined;
   const backupBucket = backupEndpoint ? bootstrapAnswer("Backup S3 bucket") : undefined;
   const backupAccessKeyId = backupEndpoint ? bootstrapAnswer("Backup S3 access-key id") : undefined;
-  const githubOAuthClientId = bootstrapAnswer("GitHub OAuth client ID");
   const cloudflareHandoffFile = genesis ? cloudflareHostHandoffPath(genesisCloudflareCheckpoint, computeReference) : bootstrapAnswer("Node-specific Cloudflare host handoff (blank for no public edge)", "");
   const cloudflareNodeName = cloudflareHandoffFile ? genesis ? computeReference : bootstrapAnswer("Cloudflare handoff node name", computeReference) : undefined;
   const databaseNetworkMode = "private-lan";
@@ -19910,7 +19884,6 @@ function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint)
         otlpTraceSampleRatio: 0.1,
         custodianEmail: role === "master" ? bootstrapAnswer("First custodian email") : undefined,
         email: emailProvider === "smtp" ? { provider: "smtp", host: smtpHost, port: smtpPort, user: smtpUser, from: emailFrom } : { provider: "jetemail", from: emailFrom, eu: jetemailEu },
-        githubOAuth: { clientId: githubOAuthClientId },
         ...backupEndpoint && backupRegion && backupBucket && backupAccessKeyId ? {
           backup: { endpoint: backupEndpoint, region: backupRegion, bucket: backupBucket, accessKeyId: backupAccessKeyId }
         } : {},
@@ -19970,8 +19943,7 @@ async function runAttendedPlatformFleet(fleet, apply, generatedClusterBootstrapC
     clusterBootstrapCode: generatedClusterBootstrapCode,
     emailSecret: environmentInput.emailSecret,
     cloudflareTunnelToken: environmentInput.cloudflareTunnelToken,
-    cloudflareApiToken: environmentInput.cloudflareApiToken,
-    githubOAuthClientSecret: environmentInput.githubOAuthClientSecret
+    cloudflareApiToken: environmentInput.cloudflareApiToken
   }) : await promptPlatformBootstrapSecrets(firstConfig, generatedClusterBootstrapCode);
   const cloudflare = await resolveCloudflareBootstrapCommandConfig(fleet.cloudflareConfigFile, {
     tunnelToken: secrets.cloudflareTunnelToken,
@@ -20075,8 +20047,8 @@ async function cmdBootstrap(options, args) {
     }
     if (operation === "metal" && args[1] === "remote") {
       const mode = args[2];
-      if (!mode || !["apply", "genesis", "rehearsal", "rehearsal-cleanup", "host-keys", "rehearsal-host-keys", "status"].includes(mode) || args[3] !== undefined) {
-        throw new Error("Usage: fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status> --bootstrap-config <owner-only-request.json> [--output <owner-only-evidence.json>] [--apply]");
+      if (!mode || !["apply", "genesis", "genesis-cleanup", "rehearsal", "rehearsal-cleanup", "host-keys", "rehearsal-host-keys", "status"].includes(mode) || args[3] !== undefined) {
+        throw new Error("Usage: fz bootstrap metal remote <apply|genesis|genesis-cleanup|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status> --bootstrap-config <owner-only-request.json> [--output <owner-only-evidence.json>] [--confirm-disposable-fleet=<exact-names>] [--apply]");
       }
       if (!options.bootstrapConfigPath)
         throw new Error("remote metal bootstrap requires --bootstrap-config");
@@ -20087,6 +20059,17 @@ async function cmdBootstrap(options, args) {
         validateMetalConfig: mode === "apply"
       });
       const plan2 = planOperatorMetalBootstrap(request, mode);
+      if (mode === "genesis-cleanup") {
+        const expected = plan2.genesisNodes.join(",");
+        if (!options.apply) {
+          out.line(JSON.stringify({ ...plan2, requiredConfirmation: expected }, null, 2));
+          out.step(`Repeat with --confirm-disposable-fleet=${expected} --apply to delete only this reviewed fleet.`);
+          return 0;
+        }
+        if (options.disposableFleetConfirmation !== expected) {
+          throw new Error(`genesis cleanup requires --confirm-disposable-fleet=${expected}`);
+        }
+      }
       if (!options.apply) {
         out.line(JSON.stringify(plan2, null, 2));
         out.step("Review the pinned metal target and exact genesis nodes, then repeat with --apply to contact the host.");
@@ -20188,7 +20171,7 @@ async function cmdBootstrap(options, args) {
       return 0;
     }
     if (!["platform", "repair"].includes(operation)) {
-      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [launch|bundle|fleet <apply|status>|remote <apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status>]|status|repair [--bootstrap-config <path>] [--apply]");
+      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [launch|bundle|fleet <apply|status>|remote <apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|genesis-cleanup|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status>]|status|repair [--bootstrap-config <path>] [--apply]");
     }
     const config = options.bootstrapConfigPath ? readBootstrapConfig(options.bootstrapConfigPath) : operation === "repair" ? (() => {
       throw new Error("repair requires --bootstrap-config so immutable coordinates are revalidated");
@@ -20858,7 +20841,7 @@ function usage() {
 	                         Persist secret-free public-node acceptance, then remove
 	                         the completed non-secret checkpoint and node handoffs
 	 fz bootstrap metal      Plan/install an identity-only physical provisioner
-	 fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status>
+	 fz bootstrap metal remote <apply|genesis|genesis-cleanup|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status>
 	                         Install/bootstrap one pinned blank metal target, then
 	                         provision the exact selected three-node genesis seed
 	 fz bootstrap status     Verify persisted profile and supervised units

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.115";
+var VERSION = "0.1.117";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/metal-provision.d.ts

@@ -8,7 +8,7 @@ export interface MetalCpuPool {
     key: string;
     /** Linux CPU-list syntax, including every SMT sibling in this pool. */
     cpus: string;
-    /** Real cores represented by cpus; checked against the commercial promise. */
+    /** Real cores represented by cpus; checked against the sellable capacity promise. */
     physicalCores: number;
     /** Linux NUMA node-list syntax. Optional on a non-NUMA machine. */
     memoryNodes?: string;

package/dist/operator-bootstrap.d.ts

@@ -90,7 +90,7 @@ export interface OperatorPlatformFleetCoordinates {
     }[];
 }
 export type OperatorPlatformBootstrapMode = 'apply' | 'status';
-export type OperatorMetalBootstrapMode = 'apply' | 'genesis' | 'rehearsal' | 'rehearsal-cleanup' | 'host-keys' | 'rehearsal-host-keys' | 'status';
+export type OperatorMetalBootstrapMode = 'apply' | 'genesis' | 'genesis-cleanup' | 'rehearsal' | 'rehearsal-cleanup' | 'host-keys' | 'rehearsal-host-keys' | 'status';
 export interface OperatorPlatformBootstrapPlan {
     kind: 'platform-remote';
     mode: OperatorPlatformBootstrapMode;

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.115";
+var VERSION = "0.1.117";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3127,6 +3127,9 @@ function platformGenesisClaims(guests, sshPublicKeys) {
     throw new Error("platform genesis requires at least one operator SSH public key");
   return reviewed.map((guest) => claimFor(guest, keys, "create"));
 }
+function platformGenesisDeletionClaims(guests) {
+  return validatePlatformGenesisGuests(guests).map((guest) => claimFor(guest, [], "delete"));
+}
 function platformCommunityRehearsalClaims(seedGuests, rehearsalGuest, sshPublicKeys) {
   const reviewed = validatePlatformGenesisGuests([...seedGuests, rehearsalGuest], 4);
   const keys = [...new Set(sshPublicKeys.map(publicKey))];
@@ -3269,9 +3272,6 @@ function validatePlatformSharedEnvironment(input) {
   } else if (input.email !== undefined) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
-  if (!input.githubOAuth || !/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubOAuth.clientId)) {
-    throw new Error("GitHub OAuth client id is malformed.");
-  }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
   if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
     throw new Error("seedSyncMembers must contain 3 to 64 unique physical host identities.");
@@ -3402,7 +3402,6 @@ function renderPlatformSharedEnvironment(input) {
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
     FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
-    FZ_GITHUB_OAUTH_CLIENT_ID: value.githubOAuth.clientId,
     FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
@@ -3414,7 +3413,6 @@ function platformApiCredentialSpecs(options) {
   const optional = [
     ["fz_smtp.password", options.emailProvider === "smtp"],
     ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
-    ["fz_oauth.github.clientSecret", options.githubOAuth],
     ["CF_API_TOKEN", options.cloudflareKv],
     ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],
@@ -3811,15 +3809,7 @@ function validatePlatformBootstrapSecrets(config, input) {
   if (!input || typeof input !== "object" || Array.isArray(input))
     throw new Error("bootstrap credential input must be an object");
   const source = input;
-  const allowed = [
-    "clusterBootstrapCode",
-    "emailSecret",
-    "enrolmentToken",
-    "backupS3Secret",
-    "cloudflareTunnelToken",
-    "cloudflareApiToken",
-    "githubOAuthClientSecret"
-  ];
+  const allowed = ["clusterBootstrapCode", "emailSecret", "enrolmentToken", "backupS3Secret", "cloudflareTunnelToken", "cloudflareApiToken"];
   const unknown = Object.keys(source).filter((key) => !allowed.includes(key));
   if (unknown.length)
     throw new Error(`bootstrap credential input contains unsupported field ${unknown[0]}`);
@@ -3829,7 +3819,6 @@ function validatePlatformBootstrapSecrets(config, input) {
   const backupS3Secret = typeof source.backupS3Secret === "string" ? source.backupS3Secret.trim() : undefined;
   const cloudflareTunnelToken = typeof source.cloudflareTunnelToken === "string" ? source.cloudflareTunnelToken.trim() : undefined;
   const cloudflareApiToken = typeof source.cloudflareApiToken === "string" ? source.cloudflareApiToken.trim() : undefined;
-  const githubOAuthClientSecret = typeof source.githubOAuthClientSecret === "string" ? source.githubOAuthClientSecret.trim() : "";
   if (!/^[a-f0-9]{64}$/i.test(clusterBootstrapCode))
     throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
   if (!emailSecret || emailSecret.length > 16384 || /[\r\n\0]/.test(emailSecret))
@@ -3849,16 +3838,12 @@ function validatePlatformBootstrapSecrets(config, input) {
   }
   if (cloudflareTunnelToken)
     validateCloudflareBootstrapSecretPair({ cloudflareTunnelToken, cloudflareApiToken });
-  if (githubOAuthClientSecret.length < 20 || githubOAuthClientSecret.length > 512 || /[\r\n\0]/.test(githubOAuthClientSecret)) {
-    throw new Error("GitHub OAuth client secret is malformed");
-  }
   return {
     clusterBootstrapCode,
     emailSecret,
     ...enrolmentToken ? { enrolmentToken } : {},
     ...backupS3Secret ? { backupS3Secret } : {},
-    ...cloudflareTunnelToken ? { cloudflareTunnelToken, cloudflareApiToken } : {},
-    githubOAuthClientSecret
+    ...cloudflareTunnelToken ? { cloudflareTunnelToken, cloudflareApiToken } : {}
   };
 }
 var platformBootstrapRunner = (config) => config.kind === "platform" && config.database.role === "master";
@@ -4781,8 +4766,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       enrolmentToken: checked4.enrolmentToken,
       backup: checked4.backupS3Secret,
       cloudflareTunnelToken: checked4.cloudflareTunnelToken,
-      cloudflareApiToken: checked4.cloudflareApiToken,
-      githubOAuthClientSecret: checked4.githubOAuthClientSecret
+      cloudflareApiToken: checked4.cloudflareApiToken
     };
   })() : undefined;
   const enrolledPrivate = config.kind === "enrolled-compute" ? validateEnrolledComputeBootstrapSecrets(config, secrets) : undefined;
@@ -4883,7 +4867,6 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "fz_smtp.password" : config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : undefined;
     for (const [name, source] of Object.entries({
       ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
-      "fz_oauth.github.clientSecret": platformPrivate.githubOAuthClientSecret,
       "backup.s3.secretAccessKey": platformPrivate.backup
     })) {
       if (source) {
@@ -4900,7 +4883,6 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const credentials = platformApiCredentialSpecs({
       emailProvider: runtime.environment.email?.provider,
       cloudflareKv: cloudflareConfigured,
-      githubOAuth: true,
       realtime: Boolean(runtime.environment.realtime)
     });
     const units = renderPlatformApiUnits({
@@ -5148,7 +5130,6 @@ function strictBootstrapDocument(value) {
       "agentOtlpEndpoint",
       "custodianEmail",
       "email",
-      "githubOAuth",
       "deployProfile",
       "otlpFlushIntervalMs",
       "otlpTraceSampleRatio",
@@ -5159,7 +5140,6 @@ function strictBootstrapDocument(value) {
       "databaseReadPreferredCoordinators"
     ], "runtime environment");
     const environment = runtime.environment;
-    exactKeys(environment.githubOAuth, ["clientId"], "GitHub OAuth config");
     if (environment.initialInventory !== undefined) {
       const inventory = exactKeys(environment.initialInventory, ["metalHostname", "metalIdentity", "region", "computes", "attestation", "deployment"], "initial inventory");
       if (inventory.metalIdentity !== undefined) {
@@ -6712,14 +6692,14 @@ function planOperatorMetalBootstrap(request, mode) {
   if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && !request.genesis.rehearsalNode) {
     throw new Error("the reviewed metal request has no rehearsal node");
   }
-  const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
+  const claims = mode === "genesis-cleanup" ? platformGenesisDeletionClaims(request.genesis.nodes) : mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
   const genesisNodes = mode === "host-keys" ? request.genesis.nodes.map(({ name }) => name) : mode === "rehearsal-host-keys" ? guestRows(request).map(({ name }) => name) : claims.map((claim) => claim.spec.guestName).filter((name) => Boolean(name));
   return {
     kind: "metal-remote",
     mode,
     mutation: !["status", "host-keys", "rehearsal-host-keys"].includes(mode),
     target: { address: request.target.address, port: request.target.port, user: request.target.user },
-    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "host-keys" || mode === "rehearsal-host-keys" ? ["verify pinned SSH transport", "collect exact Ed25519 host keys for the reviewed guest addresses"] : mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the three reviewed seed claims plus the reviewed fourth Community rehearsal claim to the constrained Metal helper" : mode === "rehearsal-cleanup" ? "delete the exact four reviewed disposable guests and their owned disks, units, seed data and inventory" : "send the three reviewed platform-genesis claims to the constrained Metal helper"] : [
+    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "host-keys" || mode === "rehearsal-host-keys" ? ["verify pinned SSH transport", "collect exact Ed25519 host keys for the reviewed guest addresses"] : mode === "genesis" || mode === "genesis-cleanup" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the three reviewed seed claims plus the reviewed fourth Community rehearsal claim to the constrained Metal helper" : mode === "genesis-cleanup" ? "delete the exact three reviewed platform guests and their owned disks, units, seed data and inventory" : mode === "rehearsal-cleanup" ? "delete the exact four reviewed disposable guests and their owned disks, units, seed data and inventory" : "send the three reviewed platform-genesis claims to the constrained Metal helper"] : [
       "verify pinned SSH transport and caller-approved SSH agent",
       "copy pinned Bun and packaged fz artifacts to private staging",
       "stage the strict owner-only metal config and optional seed handoff",
@@ -7412,13 +7392,13 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
         output: JSON.stringify(await collectOperatorGuestHostKeys(request, { ...options, exec }, mode === "rehearsal-host-keys"))
       };
     }
-    if (mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup") {
+    if (mode === "genesis" || mode === "genesis-cleanup" || mode === "rehearsal" || mode === "rehearsal-cleanup") {
       const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
       if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && !request.genesis.rehearsalNode) {
         throw new Error("the reviewed metal request has no rehearsal node");
       }
       const outputs = [];
-      const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
+      const claims = mode === "genesis-cleanup" ? platformGenesisDeletionClaims(request.genesis.nodes) : mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(request.genesis.nodes, request.genesis.rehearsalNode) : platformCommunityRehearsalClaims(request.genesis.nodes, request.genesis.rehearsalNode, keys) : platformGenesisClaims(request.genesis.nodes, keys);
       for (const claim of claims) {
         outputs.push(await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz-agent", "metal-apply", "--claim=-"], `provision ${claim.spec.guestName}`, false, `${JSON.stringify(claim)}
 `));

package/dist/platform-bootstrap-runtime.d.ts

@@ -68,14 +68,6 @@ export type PlatformBootstrapEmail = {
     from: string;
     eu: boolean;
 };
-/**
- * Public coordinates for one GitHub App. Its client secret, RSA private key and
- * webhook secret are attended inputs sealed as systemd credentials and later
- * imported into the unlocked platform Vault.
- */
-export interface PlatformBootstrapGitHubOAuth {
-    clientId: string;
-}
 export interface PlatformSharedEnvironment {
     softwareProfile: PlatformSoftwareProfile;
     databaseRole: PlatformDatabaseRole;
@@ -107,7 +99,6 @@ export interface PlatformSharedEnvironment {
     otlpTraceSampleRatio: number;
     custodianEmail?: string;
     email?: PlatformBootstrapEmail;
-    githubOAuth: PlatformBootstrapGitHubOAuth;
     backup?: {
         endpoint: string;
         region: string;
@@ -135,13 +126,12 @@ export declare function validatePlatformSharedEnvironment(input: PlatformSharedE
 /** Render only non-secret runtime coordinates. Passwords/tokens have no field in this contract. */
 export declare function renderPlatformSharedEnvironment(input: PlatformSharedEnvironment): string;
 export interface SystemdCredentialSpec {
-    name: 'arangodb-jwt' | 'arangodb-root-password' | 'seed-sync-root' | 'fz_smtp.password' | 'fz_jetemail.apiKey' | 'fz_oauth.github.clientSecret' | 'CF_API_TOKEN' | 'CF_TUNNEL_TOKEN' | 'REALTIME_PUBLISH_SECRET' | 'REALTIME_TICKET_SECRET';
+    name: 'arangodb-jwt' | 'arangodb-root-password' | 'seed-sync-root' | 'fz_smtp.password' | 'fz_jetemail.apiKey' | 'CF_API_TOKEN' | 'CF_TUNNEL_TOKEN' | 'REALTIME_PUBLISH_SECRET' | 'REALTIME_TICKET_SECRET';
     encryptedPath: string;
     required: boolean;
 }
 export declare function platformApiCredentialSpecs(options: {
     emailProvider?: PlatformBootstrapEmail['provider'];
-    githubOAuth: boolean;
     cloudflareKv: boolean;
     realtime: boolean;
 }): SystemdCredentialSpec[];

package/dist/platform-bootstrap-runtime.js

@@ -669,6 +669,9 @@ function platformGenesisClaims(guests, sshPublicKeys) {
     throw new Error("platform genesis requires at least one operator SSH public key");
   return reviewed.map((guest) => claimFor(guest, keys, "create"));
 }
+function platformGenesisDeletionClaims(guests) {
+  return validatePlatformGenesisGuests(guests).map((guest) => claimFor(guest, [], "delete"));
+}
 function platformCommunityRehearsalClaims(seedGuests, rehearsalGuest, sshPublicKeys) {
   const reviewed = validatePlatformGenesisGuests([...seedGuests, rehearsalGuest], 4);
   const keys = [...new Set(sshPublicKeys.map(publicKey))];
@@ -828,9 +831,6 @@ function validatePlatformSharedEnvironment(input) {
   } else if (input.email !== undefined) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
-  if (!input.githubOAuth || !/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubOAuth.clientId)) {
-    throw new Error("GitHub OAuth client id is malformed.");
-  }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
   if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
     throw new Error("seedSyncMembers must contain 3 to 64 unique physical host identities.");
@@ -961,7 +961,6 @@ function renderPlatformSharedEnvironment(input) {
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
     FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
-    FZ_GITHUB_OAUTH_CLIENT_ID: value.githubOAuth.clientId,
     FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
@@ -973,7 +972,6 @@ function platformApiCredentialSpecs(options) {
   const optional = [
     ["fz_smtp.password", options.emailProvider === "smtp"],
     ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
-    ["fz_oauth.github.clientSecret", options.githubOAuth],
     ["CF_API_TOKEN", options.cloudflareKv],
     ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],

package/dist/platform-fleet-verification.js

@@ -3009,7 +3009,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.115";
+var VERSION3 = "0.1.117";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -4185,6 +4185,9 @@ function platformGenesisClaims(guests, sshPublicKeys) {
     throw new Error("platform genesis requires at least one operator SSH public key");
   return reviewed.map((guest) => claimFor(guest, keys, "create"));
 }
+function platformGenesisDeletionClaims(guests) {
+  return validatePlatformGenesisGuests(guests).map((guest) => claimFor(guest, [], "delete"));
+}
 function platformCommunityRehearsalClaims(seedGuests, rehearsalGuest, sshPublicKeys) {
   const reviewed = validatePlatformGenesisGuests([...seedGuests, rehearsalGuest], 4);
   const keys = [...new Set(sshPublicKeys.map(publicKey))];
@@ -4344,9 +4347,6 @@ function validatePlatformSharedEnvironment(input) {
   } else if (input.email !== undefined) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
-  if (!input.githubOAuth || !/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubOAuth.clientId)) {
-    throw new Error("GitHub OAuth client id is malformed.");
-  }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
   if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
     throw new Error("seedSyncMembers must contain 3 to 64 unique physical host identities.");
@@ -4477,7 +4477,6 @@ function renderPlatformSharedEnvironment(input) {
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
     FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
-    FZ_GITHUB_OAUTH_CLIENT_ID: value.githubOAuth.clientId,
     FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
@@ -4489,7 +4488,6 @@ function platformApiCredentialSpecs(options) {
   const optional = [
     ["fz_smtp.password", options.emailProvider === "smtp"],
     ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
-    ["fz_oauth.github.clientSecret", options.githubOAuth],
     ["CF_API_TOKEN", options.cloudflareKv],
     ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],

package/dist/platform-genesis.d.ts

@@ -21,6 +21,8 @@ export interface PlatformGenesisGuest {
 export declare function validatePlatformGenesisGuests(guests: readonly PlatformGenesisGuest[], expectedCount?: number): readonly PlatformGenesisGuest[];
 /** Convert reviewed desired state into the ordinary Metal provisioning claim. */
 export declare function platformGenesisClaims(guests: readonly PlatformGenesisGuest[], sshPublicKeys: readonly string[]): readonly RemoteProvisionClaim[];
+/** Exact inverse of the reviewed three-node platform seed. */
+export declare function platformGenesisDeletionClaims(guests: readonly PlatformGenesisGuest[]): readonly RemoteProvisionClaim[];
 /** Add one explicitly reviewed disposable node to the same three guest requests. */
 export declare function platformCommunityRehearsalClaims(seedGuests: readonly PlatformGenesisGuest[], rehearsalGuest: PlatformGenesisGuest, sshPublicKeys: readonly string[]): readonly RemoteProvisionClaim[];
 /** Exact inverse of the reviewed disposable four-host request. */

package/dist/platform-genesis.js

@@ -669,6 +669,9 @@ function platformGenesisClaims(guests, sshPublicKeys) {
     throw new Error("platform genesis requires at least one operator SSH public key");
   return reviewed.map((guest) => claimFor(guest, keys, "create"));
 }
+function platformGenesisDeletionClaims(guests) {
+  return validatePlatformGenesisGuests(guests).map((guest) => claimFor(guest, [], "delete"));
+}
 function platformCommunityRehearsalClaims(seedGuests, rehearsalGuest, sshPublicKeys) {
   const reviewed = validatePlatformGenesisGuests([...seedGuests, rehearsalGuest], 4);
   const keys = [...new Set(sshPublicKeys.map(publicKey))];
@@ -681,6 +684,7 @@ function platformCommunityRehearsalDeletionClaims(seedGuests, rehearsalGuest) {
 }
 export {
   validatePlatformGenesisGuests,
+  platformGenesisDeletionClaims,
   platformGenesisClaims,
   platformCommunityRehearsalDeletionClaims,
   platformCommunityRehearsalClaims

package/dist/platform-launch-env.d.ts

@@ -4,7 +4,6 @@ export interface PlatformLaunchEnvironmentInput {
     emailSecret: string;
     cloudflareTunnelToken: string;
     cloudflareApiToken: string;
-    githubOAuthClientSecret: string;
 }
 /**
  * Read the development-only attended-launch adapter.

package/dist/platform-launch-profile.d.ts

@@ -45,10 +45,6 @@ export interface ForgeZeroLaunchOwnerInput {
         from: string;
         eu: boolean;
     };
-    /** Required bootstrap identity provider. Repository automation is configured after genesis. */
-    githubOAuth: {
-        clientId: string;
-    };
 }
 /**
  * ForgeZero's own genesis public coordinates. They are reviewed source data,

package/dist/provision.js

@@ -3009,7 +3009,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.115";
+var VERSION3 = "0.1.117";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.115";
+export declare const VERSION = "0.1.117";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.115",
+  "version": "0.1.117",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",
@@ -11,13 +11,13 @@
     "typescript": "^5.6.0",
     "@types/bun": "latest",
     "@types/node": "^22.0.0",
-    "@forgezero/access": "0.1.9",
+    "@forgezero/access": "0.1.11",
     "@noble/curves": "^2.2.0",
     "@noble/post-quantum": "^0.6.1"
   },
   "dependencies": {
-    "@forgezero/runtime": "0.1.14",
-    "@forgezero/vault": "0.1.20",
+    "@forgezero/runtime": "0.1.16",
+    "@forgezero/vault": "0.1.21",
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
     "@noble/post-quantum": "0.6.1",