apps:
  - app: market-bidder
    entry: hono-bidder
    options:
      - {name: service-name, to: options}
      - {name: private-key-hex, to: state}
      - {name: plc-directory-url, to: network.plcDirectoryUrl}
      - {name: atproto-oauth, to: options}
      - {name: atproto-oauth-qr, to: options}
      - {name: oauth-client-id, to: options}
      - {name: oauth-redirect-uri, to: options}
      - {name: oauth-session-path, to: state}
      - {name: state-dir, to: state}
      - {name: qr-origin, to: network.qrOrigin}
      - {name: network-hosts, to: network.hosts}
      - {name: ingress-proxy-host, to: network.ingressProxyHost}
      - {name: comms-mode, to: spec.comms.mode}
      - {name: comms-event-source, to: spec.comms.eventSourceRefs}
      - {name: atproto-identity-mode, to: spec.identity.mode}
      - {name: atproto-handle, to: spec.identity.handle}
      - {name: atproto-password, to: state}
      - {name: atproto-pds-url, to: spec.identity.pdsUrl}
      - {name: market-identity-name, to: options}
      - {name: market-identity-kcp-server, to: options}
      - {name: market-identity-kcp-workspace, to: options}
      - {name: market-identity-kcp-token-file, to: state}
      - {name: market-identity-kcp-ca-cert-file, to: options}
      - {name: identity-vault-mount, to: options}
      - {name: identity-vault-address, to: options}
      - {name: identity-vault-token-file, to: state}
      - {name: identity-vault-ca-cert-file, to: options}
      - {name: identity-vault-namespace, to: options}
      - {name: identity-vault-openbao-server, to: profile}
      - {name: identity-vault-openbao-client, to: profile}
      - {name: identity-vault-openbao-client-dir, to: profile}
      - {name: identity-vault-kcp-server, to: profile}
      - {name: identity-vault-kcp-token, to: state}
      - {name: identity-vault-kcp-workspace, to: profile}
      - {name: identity-vault-kcp-token-file, to: state}
      - {name: identity-vault-kcp-ca-cert-file, to: profile}
      - {name: compute-provider-kcp, to: options}
      - {name: compute-provider-kcp-server, to: options}
      - {name: compute-provider-kcp-workspace, to: options}
      - {name: compute-provider-kcp-token-file, to: state}
      - {name: compute-provider-kcp-ca-file, to: options}
      - {name: compute-provider-kcp-guest-login-mount, to: options}
      - {name: compute-provider-kcp-guest-identity-resync-sec, to: options}
      - {name: compute-provider-kcp-handle, to: options}
      - {name: compute-provider-kcp-guest-host-address, to: options}
      - {name: ingress-key-dir, to: state}
      - {name: compute-provider-deno-worker, to: options}
      - {name: worker-permission-mode, to: options}
      - {name: no-ingress-proxy, to: options}
      - {name: serve-addr, to: listener}
      - {name: serve-port, to: listener}
      - {name: serve-unix, to: listener}
      - {name: firehose-mode, to: options}
      - {name: oauth-session-client-id, to: options}
      - {name: skip-qr, to: options}
      - {name: associate-with, to: options}
      - {name: guest-tls-port, to: network.guestTlsUrl}
      - {name: private-key-hex-path, to: state}
      - {name: repo-pds-url, to: profile}
      - {name: policy, to: spec.policy}
      - {name: guest-lan-udp, to: spec.guestNetwork.lanUDP}
      - {name: guest-host-udp, to: spec.guestNetwork.hostUDP}
      - {name: policy-args, to: options}
      - {name: operator-signin, to: options}
      - {name: operator-signin-mode, to: options}
      - {name: operator-pds-url, to: options}
      - {name: ingress-provider, to: spec.ingress.provider}
      - {name: ingress-public-host, to: spec.ingress.publicHost}
      - {name: ingress-xrpc-host, to: spec.ingress.xrpc.ingressProxyHost}
      - {name: ingress-relay-url, to: spec.ingress.xrpc.relayURL}
      - {name: ingress-opentunnel-command, to: spec.ingress.opentunnel.command}
      - {name: ingress-opentunnel-route-name, to: spec.ingress.opentunnel.routeName}
      - {name: ingress-opentunnel-local-host, to: spec.ingress.opentunnel.localHost}
      - {name: ingress-opentunnel-proxy-protocol, to: spec.ingress.opentunnel.proxyProtocol}
      - {name: only-remote-policy-exec, to: options}
      - {name: allow-untrusted-policy-exec, to: options}
      - {name: offering-refresh-sec, to: options}
      - {name: bid-ttl-sec, to: options}
      - {name: bid-quota, to: profile}
      - {name: computevm-quota, to: profile}
      - {name: tls-cert-file, to: profile}
      - {name: tls-key-file, to: profile}
      - {name: port-file, to: listener}
      - {name: listeners-file, to: listener}
      - {name: status-file, to: listener}
      - {name: denopod-namespace, to: profile}
      - {name: denopod-service-domain, to: profile}
  - app: gateway
    entry: hono-socialweb-computer-k8s
    options:
      - {name: http-port, to: listener}
      - {name: serve-addr, to: listener}
      - {name: port-file, to: listener}
      - {name: tls-cert-file, to: profile}
      - {name: tls-key-file, to: profile}
      - {name: state-dir, to: state}
      - {name: web-dir, to: profile}
      - {name: kcp-kubeconfig, to: options}
      - {name: kcp-server, to: profile}
      - {name: kcp-token-file, to: profile}
      - {name: kcp-ca-file, to: profile}
      - {name: openbao-client-dir, to: profile}
      - {name: kcp-context, to: options}
      - {name: gateway-url, to: options}
      - {name: gateway-kcp-workspace, to: profile}
      - {name: gateway-kcp-name, to: profile}
      - {name: gateway-kcp-listener, to: options}
      - {name: openbao-server, to: profile}
      - {name: openbao-client, to: profile}
      - {name: openbao-server-workspace, to: profile}
      - {name: market-identity-workspace, to: profile}
      - {name: contract-kcp-workspace, to: profile}
      - {name: cluster-ca-dir, to: profile}
      - {name: label, to: options}
      - {name: public-origin, to: options}
      - {name: session-cookie-max-age-sec, to: options}
      - {name: atproto-role, to: profile}
      - {name: openbao-atproto-mount, to: profile}
      - {name: plc-directory-url, to: network.plcDirectoryUrl}
      - {name: network-hosts, to: network.hosts}
      - {name: ingress-proxy-host, to: network.ingressProxyHost}
      - {name: comms-mode, to: spec.comms.mode}
      - {name: comms-event-source, to: spec.comms.eventSourceRefs}
      - {name: gateway-audience, to: options}
      - {name: kcp-public-host, to: options}
      - {name: kubeconfig-max-ttl-sec, to: options}
      - {name: downloads-subdir, to: options}
      - {name: downloads-dir, to: profile}
      - {name: required-downloads, to: profile}
      - {name: test-node-download-host, to: profile}
      - {name: node-extra-bidder-dids, to: spec.bidderDids}
      - {name: node-policy, to: options}
      - {name: node-policy-args, to: options}
      - {name: vm-ready-timeout-sec, to: options}
      - {name: test-owner-sessions-file, to: spec.marketNetwork.ownerSessionsFile}
      - {name: test-node-user-data-base-file, to: spec.marketNetwork.nodeUserDataBaseFile}
  - app: market-requester
    entry: request-vm-ssh
    options:
      - {name: status-file, to: listener}
      - {name: kcp-server, to: profile}
      - {name: port, to: listener}
      - {name: serve-addr, to: listener}
      - {name: serve-unix, to: listener}
      - {name: port-file, to: listener}
      - {name: listeners-file, to: listener}
      - {name: tls-cert-file, to: profile}
      - {name: tls-key-file, to: profile}
      - {name: label, to: options}
      - {name: plc-directory-url, to: network.plcDirectoryUrl}
      - {name: ingress-proxy-host, to: network.ingressProxyHost}
      - {name: comms-mode, to: spec.comms.mode}
      - {name: comms-event-source, to: spec.comms.eventSourceRefs}
      - {name: requester-ingress-provider, to: spec.requesterIngress.provider}
      - {name: requester-ingress-webrtc-stun, to: spec.requesterIngress.webrtc.stunUrls}
      - {name: qr-origin, to: network.qrOrigin}
      - {name: network-hosts, to: network.hosts}
      - {name: ingress-provider, to: spec.ingress.provider}
      - {name: ingress-public-host, to: spec.ingress.publicHost}
      - {name: ingress-xrpc-host, to: spec.ingress.xrpc.ingressProxyHost}
      - {name: ingress-relay-url, to: spec.ingress.xrpc.relayURL}
      - {name: ingress-opentunnel-command, to: spec.ingress.opentunnel.command}
      - {name: ingress-opentunnel-route-name, to: spec.ingress.opentunnel.routeName}
      - {name: ingress-opentunnel-local-host, to: spec.ingress.opentunnel.localHost}
      - {name: ingress-opentunnel-proxy-protocol, to: spec.ingress.opentunnel.proxyProtocol}
      - {name: accept-copies, to: options}
      - {name: firehose-mode, to: options}
      - {name: no-ingress-proxy, to: options}
      - {name: atproto-identity-mode, to: spec.identity.mode}
      - {name: atproto-oauth, to: spec.identity.mode}
      - {name: atproto-oauth-qr, to: spec.identity.mode}
      - {name: atproto-handle, to: spec.identity.handle}
      - {name: expect-handle, to: spec.identity.handle}
      - {name: atproto-pds-url, to: spec.identity.pdsUrl}
      - {name: skip-qr, to: spec.identity.association}
      - {name: market-identity-name, to: profile}
      - {name: market-identity-kcp-server, to: profile}
      - {name: market-identity-kcp-workspace, to: profile}
      - {name: market-identity-kcp-token-file, to: state}
      - {name: market-identity-kcp-ca-cert-file, to: profile}
      - {name: repo-pds-url, to: profile}
      - {name: max-concurrent, to: options}
      - {name: per-account-max, to: options}
      - {name: unclaimed-grace-ms, to: options}
      - {name: orphan-scan-interval-ms, to: options}
      - {name: compute-contract-kcp-server, to: profile}
      - {name: compute-contract-kcp-workspace, to: profile}
      - {name: compute-contract-kcp-token-file, to: state}
      - {name: compute-contract-kcp-ca-cert-file, to: profile}
      - {name: identity-vault-mount, to: profile}
      - {name: identity-vault-openbao-server, to: profile}
      - {name: identity-vault-openbao-client, to: profile}
      - {name: identity-vault-openbao-client-dir, to: profile}
      - {name: identity-vault-kcp-server, to: profile}
      - {name: identity-vault-kcp-workspace, to: profile}
      - {name: identity-vault-kcp-token-file, to: state}
      - {name: identity-vault-kcp-ca-cert-file, to: profile}
      - {name: identity-vault-file, to: state}
      - {name: identity-vault-address, to: state}
      - {name: identity-vault-token-file, to: state}
      - {name: identity-vault-ca-cert-file, to: state}
      - {name: identity-vault-namespace, to: state}
      - {name: private-key-hex, to: state}
      - {name: private-key-hex-path, to: state}
      - {name: oauth-session-path, to: state}
      - {name: oauth-session-file, to: state}
      - {name: state-dir, to: state}
      - {name: pds-state-path, to: state}
      - {name: oauth-client-id, to: options}
      - {name: oauth-redirect-uri, to: options}
      - {name: oauth-session-client-id, to: options}
      - {name: bidder-dids, to: spec.bidderDids}
      - {name: allow-bidder-dids, to: contract.bidderDids}
      - {name: deny-bidder-dids, to: contract.denyBidderDids}
      - {name: vm-name, to: contract.vmName}
      - {name: user-data, to: contract.userData}
      - {name: compute-kind, to: contract.computeKind}
      - {name: ssh-authorized-key, to: contract.sshAuthorizedKeys}
      - {name: policy, to: contract.policy}
      - {name: policy-args, to: contract.policyArgs}
      - {name: vm-ready-timeout-sec, to: contract.vmReadyTimeoutSec}
      - {name: secrets, to: contract.secretsRef}
      - {name: agent, to: contract.agent}
      - {name: guest-tools, to: contract.guestTools}
      - {name: associate, to: contract.association}
      - {name: association-ref, to: spec.identity.associationRef}
      - {name: secrets-fallback, to: spec.secretsFallback}
      - {name: tunnel, to: contract.tunnels}
      - {name: guest-host-aliases, to: options}
      - {name: guest-ca-file, to: profile}
      - {name: guest-curl-home, to: profile}
      - {name: skip-rbac, to: options}
      - {name: policy-engine, to: options}
      - {name: only-remote-policy-exec, to: options}
      - {name: allow-untrusted-policy-exec, to: options}
      - {name: exec, to: cli}
      - {name: hold, to: cli}
      - {name: keep-vm, to: cli}
      - {name: skip-ssh, to: cli}
      - {name: fedproxy-host, to: removed, reason: legacy-transport}
      - {name: user-data-transport, to: removed, reason: legacy-transport}
  - app: ssh-gateway
    entry: hono-socialweb-computer-ssh
    options:
      - {name: ssh-port, to: listener}
      - {name: ssh-hostname, to: listener}
      - {name: ssh-public-host, to: options}
      - {name: http-port, to: listener}
      - {name: serve-addr, to: listener}
      - {name: port-file, to: listener}
      - {name: listeners-file, to: listener}
      - {name: state-dir, to: state}
      - {name: host-key-path, to: state}
      - {name: default-command, to: options}
      - {name: vm-ready-timeout-sec, to: options}
      - {name: plc-directory-url, to: network.plcDirectoryUrl}
      - {name: associations-cache-ttl-sec, to: options}
      - {name: label, to: options}
      - {name: web-dir, to: profile}
      - {name: max-sessions, to: options}
      - {name: sessions-per-account, to: options}
      - {name: max-connections, to: options}
      - {name: auth-timeout-sec, to: options}
      - {name: session-max-sec, to: options}
      - {name: session-cookie-max-age-sec, to: options}
      - {name: atproto-role, to: profile}
      - {name: openbao-atproto-mount, to: profile}
      - {name: public-origin, to: options}
      - {name: ingress-proxy-host, to: network.ingressProxyHost}
      - {name: comms-mode, to: spec.comms.mode}
      - {name: comms-event-source, to: spec.comms.eventSourceRefs}
      - {name: requester-ingress-provider, to: spec.requesterIngress.provider}
      - {name: requester-ingress-webrtc-stun, to: spec.requesterIngress.webrtc.stunUrls}
      - {name: network-hosts, to: network.hosts}
      - {name: bidder-dids, to: spec.bidderDids}
      - {name: ssh-public-listen, to: spec.ssh.publicListen}
      - {name: ssh-web-listen, to: spec.ssh.webListen}
      - {name: ssh-operator-did, to: spec.ssh.operatorDid}
      - {name: ssh-max-accounts, to: spec.ssh.maxAccounts}
      - {name: guest-host-aliases, to: profile}
      - {name: guest-ca-file, to: profile}
      - {name: guest-curl-home, to: profile}
      - {name: kcp-server, to: profile}
      - {name: openbao-server, to: profile}
      - {name: openbao-client, to: profile}
      - {name: openbao-client-dir, to: profile}
      - {name: openbao-kcp-server, to: profile}
      - {name: openbao-kcp-workspace, to: profile}
      - {name: openbao-kcp-token-file, to: state}
      - {name: openbao-kcp-ca-cert-file, to: profile}
      - {name: iroh-dial-socket, to: profile}
      - {name: test-owner-sessions-file, to: spec.ownerSessionsFile}
      - {name: app-did, to: options}
      - {name: app-handle, to: options}
      - {name: app-pds-kv-path, to: state}
      - {name: app-pds-crawlers, to: options}
      - {name: cocore-api-base-url, to: options}
      - {name: cocore-app-name, to: options}
      - {name: cocore-return-url, to: options}
      - {name: tls-cert-file, to: profile}
      - {name: tls-key-file, to: profile}