{
  "name": "socialweb-computer",
  "description": "socialweb-computer: one multi-call binary whose subcommand tree is the stack",
  "options": {
    "host-backend": {
      "type": "string",
      "description": "Placement backend for long-lived host processes: systemd-user (installs) or proc (dev, tests). Required: no default, never probed",
      "env": "SOCIALWEB_HOST_BACKEND"
    },
    "instance": {
      "type": "string",
      "description": "Application instance id (dev: derived from the worktree when unset)",
      "env": "SOCIALWEB_INSTANCE"
    },
    "state-dir": {
      "type": "string",
      "description": "State root; resolved by install or dev, no default here",
      "env": "SOCIALWEB_STATE_DIR"
    },
    "instance-dir": {
      "type": "string",
      "description": "State directory of one application instance (the dev core reads its instance.json there)",
      "env": "SOCIALWEB_INSTANCE_DIR"
    },
    "kcp-base-workspace": {
      "type": "string",
      "description": "Workspace every role addresses its objects under",
      "env": "SOCIALWEB_KCP_BASE_WORKSPACE",
      "default": "root"
    },
    "asset-cache": {
      "type": "string",
      "description": "Extraction root of embedded assets (dev: the per-user $XDG_CACHE_HOME/socialweb-computer/runtime when unset)",
      "env": "SOCIALWEB_ASSET_CACHE"
    },
    "asset-gc-window": {
      "type": "string",
      "description": "dev gc: an asset dir used within this window is kept (Go duration)",
      "env": "SOCIALWEB_ASSET_GC_WINDOW",
      "default": "24h"
    },
    "profile": {
      "type": "string",
      "description": "Dev profile: quick (kine on sqlite + one kcp slot), prodlike (the gateway shape: a postgres unit, one kine per kcp slot on it, blue/green slots a and b behind the front) or market-network (a quick-shaped instance whose MarketNetwork root object runs the shared atproto services and composes child applications, each in its own workspace root:<app> of the one kcp). run bidder: the MarketBidder profile, prod-qr (the production profile; its identity defaults to a local repo and PDS, and -- --atproto-oauth-qr signs in the handle's real account instead), market-network (the bidder's own account on the market network's PDS; needs --network) or dev-local (a local repo, the ephemeral-PDS mode); unset: market-network with --network or --market-network-file, prod-qr otherwise",
      "env": "SOCIALWEB_DEV_PROFILE"
    },
    "bidders": {
      "type": "number",
      "description": "dev up --profile market-network: how many MarketBidder child applications the network composes (bidder-1 .. bidder-N), each in its own workspace root:<app> of the network's one kcp",
      "env": "SOCIALWEB_DEV_BIDDERS",
      "default": 1
    },
    "with-gateway": {
      "type": "boolean",
      "description": "dev up --profile market-network: also compose a Gateway child application in its own workspace of the network's kcp. run requester: also apply a Gateway root of profile requester (spec.requesterRef: the MarketRequester app) into the requester's workspace and run its clusterprovider in the run requester process, so a tenant cluster's k3s and kine are HostProcesses of the requester's core and its nodes are rented by the MarketRequester's Requester under the user's DID; preflights cgroup v2, delegation, subuid/subgid and the uidmap helpers; recorded in requester.json, so a restart keeps it"
    },
    "node-download-base": {
      "type": "string",
      "description": "run requester --with-gateway: the public base a tenant cluster's node fetches socialweb-meshd and socialweb-node from, as <base>/downloads/<sha256>/<name>, checking the sha256 its contract pins; the default is the public bucket CI publishes the pinned downloads tree to by sha256. With --network the default is unused and the node fetches from the requester's local Exposure (the network's bidders share its host); an empty value does the same everywhere",
      "env": "SOCIALWEB_NODE_DOWNLOAD_BASE",
      "default": "https://socialweb-computer-kcp.sfo3.digitaloceanspaces.com"
    },
    "cluster": {
      "type": "string",
      "description": "run requester cluster and kubeconfig: the tenant cluster, a DNS label; run requester cluster <name> --cluster <c> makes the account and home workspaces of the requester's DID and the Cluster {account: <did>, running: true} in root:<account>:<c>; run requester kubeconfig <name> --cluster <c> prints the path of its admin kubeconfig"
    },
    "app-values": {
      "type": "string",
      "description": "dev up --profile market-network: a YAML file merged over the built-in market-network defaults (keys bidder and gateway: the NetworkApp fields every bidder or the gateway gets, e.g. bidder.firecracker)",
      "env": "SOCIALWEB_DEV_APP_VALUES"
    },
    "network-timeout": {
      "type": "string",
      "description": "How long dev up waits for the MarketNetwork and every child application to report Ready, and how long install bidder gives the guest image download; a third of it, at least 30s, is the budget install bidder gives the search of the release base for that image, and install bidder refuses a value under 30s (Go duration)",
      "env": "SOCIALWEB_DEV_NETWORK_TIMEOUT",
      "default": "3m"
    },
    "parent": {
      "type": "string",
      "description": "dev up: the dev host instance (dev host; dev-host by default there) whose kcp holds this instance's bootstrap units as HostProcess objects in root:dev:<instance>, placed by the parent's supervisor; unset runs the instance under its own devsup",
      "env": "SOCIALWEB_DEV_PARENT"
    },
    "postgres-root": {
      "type": "string",
      "description": "dev up: absolute root of the extracted postgres asset tree (versions.json postgres) that runs kcp's store in prodlike and every Postgres object (dev build: explicit, never PATH; a release build extracts its embedded postgres)",
      "env": "SOCIALWEB_POSTGRES_ROOT"
    },
    "stand-ins": {
      "type": "string",
      "description": "dev up: a JSON file naming the units to place instead of a profile's bootstrap layer, in order ([{role, exec, env, listens}]); the instance then has no kcp (tests place stand-ins this way)"
    },
    "kcp-path": {
      "type": "string",
      "description": "Absolute path of the kcp release executable (dev build: explicit, never PATH; units roll kcp: the target asset, unset keeps the current one)",
      "env": "SOCIALWEB_KCP_PATH"
    },
    "kine-path": {
      "type": "string",
      "description": "Absolute path of the kine executable (dev build: explicit, never PATH; units roll kcp: the target asset, unset keeps the current one)",
      "env": "SOCIALWEB_KINE_PATH"
    },
    "bao-path": {
      "type": "string",
      "description": "Absolute path of the OpenBao bao executable an OpenBaoServer with asset bao runs (dev build: explicit, never PATH, optional; a release build extracts its embedded bao)",
      "env": "SOCIALWEB_BAO_PATH"
    },
    "openbao-plugin-dir": {
      "type": "string",
      "description": "Directory holding the OpenBao plugin executables (openbao-plugin-auth-sshsig) an OpenBaoServer's spec.plugins names (dev build: explicit, never PATH, optional; a release build extracts its embedded plugins)",
      "env": "SOCIALWEB_OPENBAO_PLUGIN_DIR"
    },
    "openbao-addr": {
      "type": "string",
      "description": "dev up: URL of the OpenBao server the core provisions OpenBao namespaces in and issues component serving certificates from (unset: components serve plain HTTP)",
      "env": "SOCIALWEB_OPENBAO_ADDR"
    },
    "openbao-token-file": {
      "type": "string",
      "description": "dev up: absolute path of the file holding the token for openbao-addr",
      "env": "SOCIALWEB_OPENBAO_TOKEN_FILE"
    },
    "ready-timeout": {
      "type": "string",
      "description": "How long dev up waits for kcp /readyz, and how long install bidder waits for the same before it gives up and records a refused bring-up step. The installed core is given it as its ready budget, and the installed unit's start timeout and watchdog are this plus six minutes, so a large value means a long start timeout (Go duration)",
      "env": "SOCIALWEB_READY_TIMEOUT",
      "default": "1m"
    },
    "owner": {
      "type": "string",
      "description": "internal apiserver-front: the application instance (or cluster) whose front this is"
    },
    "kcp-front-address": {
      "type": "string",
      "description": "Listen address of kcp's L4 front: dev and bidders pass 127.0.0.1:0 (the port is read back); only the gateway's prod config.json sets 127.0.0.1:6443",
      "env": "SOCIALWEB_KCP_FRONT_ADDRESS"
    },
    "front-control": {
      "type": "string",
      "description": "internal apiserver-front: the control socket the core sets the backend through (under 108 bytes)"
    },
    "front-state": {
      "type": "string",
      "description": "internal apiserver-front: the file holding the chosen backend across front restarts"
    },
    "front-fd-store": {
      "type": "boolean",
      "description": "internal apiserver-front: hand the listening socket to the service manager's fd store (NOTIFY_SOCKET) and take it back from LISTEN_FDS"
    },
    "keep-state": {
      "type": "boolean",
      "description": "dev down: keep the instance state directory"
    },
    "fg": {
      "type": "boolean",
      "description": "dev up: keep the instance bound to this terminal; devsup dies with dev up and Ctrl-C is dev down. run requester always stays in the foreground and takes --fg as a no-op (the form an installed unit passes)"
    },
    "binary": {
      "type": "string",
      "description": "dev restart core and upgrade: absolute path of the socialweb-computer executable to run next (dev restart: this executable when unset)",
      "env": "SOCIALWEB_DEV_CORE_BINARY"
    },
    "tail": {
      "type": "number",
      "description": "dev logs: print only the last N lines (0 prints the whole log)",
      "default": 0
    },
    "json": {
      "type": "boolean",
      "description": "Print JSON"
    },
    "state": {
      "type": "string",
      "description": "internal devsup: the supervisor state directory"
    },
    "socket": {
      "type": "string",
      "description": "internal devsup: the unix socket path (under 108 bytes); internal iroh-dial: the unix socket the iroh dialer listens on (under 108 bytes)"
    },
    "die-with": {
      "type": "number",
      "description": "internal devsup and dev up: stop every unit and exit when this pid exits (0 = never; a test passes its own pid)",
      "default": 0
    },
    "clusterprovider-advertise-address": {
      "type": "string",
      "description": "Address tenant nodes dial for the cluster control plane",
      "env": "SOCIALWEB_CLUSTERPROVIDER_ADVERTISE_ADDRESS"
    },
    "clusterprovider-audit-policy": {
      "type": "string",
      "description": "Audit policy file for tenant apiservers",
      "env": "SOCIALWEB_CLUSTERPROVIDER_AUDIT_POLICY"
    },
    "clusterprovider-cloud-controller-manager": {
      "type": "string",
      "description": "Path of the cloud-controller-manager executable",
      "env": "SOCIALWEB_CLUSTERPROVIDER_CLOUD_CONTROLLER_MANAGER"
    },
    "clusterprovider-datastore-has-row": {
      "type": "boolean",
      "description": "The tenant datastore already holds rows (skip the fresh-store check)",
      "env": "SOCIALWEB_CLUSTERPROVIDER_DATASTORE_HAS_ROW"
    },
    "clusterprovider-dumbpipe": {
      "type": "string",
      "description": "Path of the dumbpipe executable",
      "env": "SOCIALWEB_CLUSTERPROVIDER_DUMBPIPE"
    },
    "clusterprovider-eso-bundle": {
      "type": "string",
      "description": "External Secrets Operator manifest bundle",
      "env": "SOCIALWEB_CLUSTERPROVIDER_ESO_BUNDLE"
    },
    "clusterprovider-external-secrets": {
      "type": "string",
      "description": "Path of the external-secrets executable",
      "env": "SOCIALWEB_CLUSTERPROVIDER_EXTERNAL_SECRETS"
    },
    "clusterprovider-firecracker": {
      "type": "string",
      "description": "Path of the firecracker executable",
      "env": "SOCIALWEB_CLUSTERPROVIDER_FIRECRACKER"
    },
    "clusterprovider-grant": {
      "type": "string",
      "description": "Tenant grant manifest",
      "env": "SOCIALWEB_CLUSTERPROVIDER_GRANT"
    },
    "clusterprovider-host": {
      "type": "string",
      "description": "Host name the clusterprovider records",
      "env": "SOCIALWEB_CLUSTERPROVIDER_HOST"
    },
    "clusterprovider-image-config": {
      "type": "string",
      "description": "Node image config file",
      "env": "SOCIALWEB_CLUSTERPROVIDER_IMAGE_CONFIG"
    },
    "clusterprovider-image-out-dir": {
      "type": "string",
      "description": "Node image output directory",
      "env": "SOCIALWEB_CLUSTERPROVIDER_IMAGE_OUT_DIR"
    },
    "clusterprovider-join": {
      "type": "string",
      "description": "Cluster the clusterprovider joins",
      "env": "SOCIALWEB_CLUSTERPROVIDER_JOIN"
    },
    "clusterprovider-lease-path": {
      "type": "string",
      "description": "Port and subnet lease file",
      "env": "SOCIALWEB_CLUSTERPROVIDER_LEASE_PATH"
    },
    "clusterprovider-network": {
      "type": "string",
      "description": "Tenant network mode",
      "env": "SOCIALWEB_CLUSTERPROVIDER_NETWORK"
    },
    "clusterprovider-node-agent": {
      "type": "string",
      "description": "Path of the node agent executable",
      "env": "SOCIALWEB_CLUSTERPROVIDER_NODE_AGENT"
    },
    "clusterprovider-node-disk-mib": {
      "type": "number",
      "description": "Node disk size in MiB",
      "env": "SOCIALWEB_CLUSTERPROVIDER_NODE_DISK_MIB"
    },
    "clusterprovider-qemu": {
      "type": "string",
      "description": "Path of the qemu executable",
      "env": "SOCIALWEB_CLUSTERPROVIDER_QEMU"
    },
    "clusterprovider-state-dir": {
      "type": "string",
      "description": "Clusterprovider state directory",
      "env": "SOCIALWEB_CLUSTERPROVIDER_STATE_DIR"
    },
    "deploy-dir": {
      "type": "string",
      "description": "Deploy directory (manifests, policies)",
      "env": "SOCIALWEB_DEPLOY_DIR"
    },
    "gateway-addr": {
      "type": "string",
      "description": "Gateway listen address",
      "env": "SOCIALWEB_GATEWAY_ADDR"
    },
    "gateway-audiences": {
      "type": "string",
      "description": "Accepted service-auth audiences (comma separated)",
      "env": "SOCIALWEB_GATEWAY_AUDIENCES"
    },
    "gateway-cluster-state-dir": {
      "type": "string",
      "description": "Directory of the cluster data dirs the gateway reads to issue and check kubeconfig client certificates",
      "env": "SOCIALWEB_GATEWAY_CLUSTER_STATE_DIR"
    },
    "gateway-kcp-public-host": {
      "type": "string",
      "description": "Public host name of kcp",
      "env": "SOCIALWEB_GATEWAY_KCP_PUBLIC_HOST"
    },
    "gateway-kcp-public-ca-file": {
      "type": "string",
      "description": "PEM file of the CA the kubeconfig carries for its public server (unset when the server has a public certificate)",
      "env": "SOCIALWEB_GATEWAY_KCP_PUBLIC_CA_FILE"
    },
    "gateway-plc-url": {
      "type": "string",
      "description": "PLC directory URL",
      "env": "SOCIALWEB_GATEWAY_PLC_URL"
    },
    "kcp-audit-log": {
      "type": "string",
      "description": "kcp audit log path",
      "env": "SOCIALWEB_KCP_AUDIT_LOG"
    },
    "kcp-audit-policy": {
      "type": "string",
      "description": "kcp audit policy file",
      "env": "SOCIALWEB_KCP_AUDIT_POLICY"
    },
    "kcp-host": {
      "type": "string",
      "description": "kcp URL consumers dial",
      "env": "SOCIALWEB_KCP_HOST"
    },
    "kcp-kubeconfig": {
      "type": "string",
      "description": "kcp admin kubeconfig",
      "env": "SOCIALWEB_KCP_KUBECONFIG"
    },
    "kcp-root": {
      "type": "string",
      "description": "kcp root directory",
      "env": "SOCIALWEB_KCP_ROOT"
    },
    "kubectl": {
      "type": "string",
      "description": "Path of kubectl (replaced by kcpapply, M1-HOST-INVENTORY)",
      "env": "SOCIALWEB_KUBECTL"
    },
    "rootvault-addr": {
      "type": "string",
      "description": "Root vault address",
      "env": "SOCIALWEB_ROOTVAULT_ADDR"
    },
    "set": {
      "type": "string",
      "description": "apply, manifests render: the manifest sets, comma-separated, in order (manifests list names them)"
    },
    "values": {
      "type": "string",
      "description": "apply, manifests render: a YAML or JSON file of typed values keyed by set name, decoded strictly"
    },
    "dry-run": {
      "type": "boolean",
      "description": "apply: server-side dry run; reports every field whose manager would change and persists nothing. install: print the computed step list and change nothing"
    },
    "phase": {
      "type": "string",
      "description": "apply, manifests render: only these phases of each set, comma-separated names or first..last ranges in set order"
    },
    "wait-timeout": {
      "type": "string",
      "description": "apply: how long each typed wait may take (Go duration)",
      "default": "1m"
    },
    "handle": {
      "type": "string",
      "description": "install bidder: the atproto handle(s) of the bidder instances, comma-separated; a re-run with another handle adds that instance. internal vm: the one bidder instance whose VMs these are. units roll kcp: the one bidder handle whose kcp restarts (unset: the gateway). dev up: makes the instance a bidder application instance whose core runs the ComputeVM controller for this handle. run bidder: the bidder's atproto handle, which also owns its ComputeVMs (in a market network: default <name>.bob.test)",
      "env": "SOCIALWEB_HANDLE"
    },
    "vm-host-backend": {
      "type": "string",
      "description": "dev up --handle, dev up --profile market-network and run bidder: the placement backend of the VM units (systemd-user | proc); default the instance's own (proc). systemd-user places them in the account's user manager, which enforces their cgroup limits",
      "env": "SOCIALWEB_VM_HOST_BACKEND"
    },
    "vm-runtime-dir": {
      "type": "string",
      "description": "internal vm and dev up --handle: the account's runtime dir; each VM's API socket lives under <dir>/swvm",
      "env": "XDG_RUNTIME_DIR"
    },
    "guest-image-source": {
      "type": "string",
      "description": "internal vm, dev up --handle, dev up --profile market-network, run bidder and install bidder (written to config.json): file:// or https:// base the pinned guest image (vmlinux, rootfs.ext4, image.json) is fetched from once and verified by sha256; run bidder without one downloads the image of its own build from guest-image-release-base instead, unless the installed bidder's own store already holds the pinned image and verifies, in which case no artifact is asked",
      "env": "SOCIALWEB_GUEST_IMAGE_SOURCE"
    },
    "guest-image-release-base": {
      "type": "string",
      "description": "The base the published guest image is searched under (guest-images/<target>/<pinned image.json sha256> first, then releases/<version>, main/<commit>, main/latest and the newest releases/v*) by run bidder and by install bidder when neither --guest-image-source nor a stored source names one; install bidder refuses an empty base, when nothing else names an image, rather than installing a bidder that can provision nothing",
      "env": "SOCIALWEB_GUEST_IMAGE_RELEASE_BASE",
      "default": "https://socialweb-computer-kcp.sfo3.digitaloceanspaces.com"
    },
    "no-guest-lan-udp": {
      "type": "boolean",
      "description": "run bidder, install bidder (written to config.json) and dev up --profile market-network: the bidder's guests send no UDP to the LAN (spec.guestNetwork.lanUDP false on the MarketBidder, the Bidder and every ComputeVM it provisions); unset, a guest may send UDP to 10/8, 172.16/12, 192.168/16 and fc00::/7 on destination ports 1024 and up except 1900, 5353 and 5355, so same-LAN WebRTC can use a LAN candidate. TCP to the LAN, the host's own addresses, 100.64/10, link-local and loopback stay closed either way",
      "env": "SOCIALWEB_NO_GUEST_LAN_UDP"
    },
    "guest-host-udp": {
      "type": "string",
      "description": "run bidder, install bidder (written to config.json) and dev up --profile market-network: true, false or auto. true lets the bidder's guests send UDP to the bidder host's own addresses on destination ports 1024 and up except 1900, 5353 and 5355 (spec.guestNetwork.hostUDP on the MarketBidder, the Bidder and every ComputeVM it provisions), so WebRTC works when the requester runs on the bidder's own host; false keeps them closed; unset or auto: on when the bidder's policy is bidder-only-me, off otherwise. Never TCP, never loopback or link-local; the bidder's status.guestNetwork reports the effective value",
      "env": "SOCIALWEB_GUEST_HOST_UDP"
    },
    "vm-stop-grace": {
      "type": "string",
      "description": "internal vm, dev up --handle and run bidder: how long a stop waits after SendCtrlAltDel before SIGKILL (Go duration; x86_64 only, arm64 kills at once); unset, the vmStop.graceSeconds measured into internal/versions/versions.json",
      "env": "SOCIALWEB_VM_STOP_GRACE"
    },
    "userns-stage-path": {
      "type": "string",
      "description": "Absolute path of swc-userns-stage (dev build: explicit, never PATH)",
      "env": "SOCIALWEB_USERNS_STAGE_PATH"
    },
    "pasta-path": {
      "type": "string",
      "description": "Absolute path of the pinned pasta (dev build: explicit, never PATH)",
      "env": "SOCIALWEB_PASTA_PATH"
    },
    "vmexec-path": {
      "type": "string",
      "description": "Absolute path of socialweb-vmexec (dev build: explicit, never PATH)",
      "env": "SOCIALWEB_VMEXEC_PATH"
    },
    "firecracker-path": {
      "type": "string",
      "description": "Absolute path of the pinned firecracker (dev build: explicit, never PATH)",
      "env": "SOCIALWEB_FIRECRACKER_PATH"
    },
    "account": {
      "type": "string",
      "description": "install/uninstall: the system account (socialweb for a gateway, swc-bidder for bidders when unset)"
    },
    "vm-slots": {
      "type": "number",
      "description": "install bidder: VM slots of 65536 subordinate ids reserved in /etc/subuid and /etc/subgid",
      "default": 256
    },
    "adopt-account": {
      "type": "boolean",
      "description": "install: take over an existing account no install record names (never needed for an account install created)"
    },
    "purge": {
      "type": "boolean",
      "description": "uninstall: also remove the state dir (vault, kcp store, keys) and the account install created"
    },
    "root": {
      "type": "string",
      "description": "install/uninstall: a staged host: the host files (/etc, the linger file, the install record) live under this directory, the state dir is used as given, the account is the invoking user and the units run in the invoking user's own manager (a proof run, no root needed)"
    },
    "force": {
      "type": "boolean",
      "description": "uninstall: proceed while VM units are active (each stopped VM becomes Lost)"
    },
    "sha256": {
      "type": "string",
      "description": "upgrade: the published sha256 of --binary; a mismatch is refused"
    },
    "allow-dev-binary": {
      "type": "boolean",
      "description": "install/upgrade: accept a dev build (version says \"dev build, not reproducible\"); for dev and test runs only, never prod"
    },
    "planned-outage": {
      "type": "boolean",
      "description": "units roll kcp: stop the old slot before the new one starts (the only path for a kcp pair without a storage-compatible kcpCompat record)"
    },
    "store-backup-keep": {
      "type": "number",
      "description": "units roll kcp, dev roll kcp: keep at most this many kcp store backups; older ones are removed after a new backup is written and checked",
      "env": "SOCIALWEB_STORE_BACKUP_KEEP",
      "default": 5
    },
    "store-backup-keep-days": {
      "type": "number",
      "description": "units roll kcp, dev roll kcp: remove kcp store backups older than this many days after a new backup is written and checked (the newest is always kept)",
      "env": "SOCIALWEB_STORE_BACKUP_KEEP_DAYS",
      "default": 14
    },
    "unit-prefix": {
      "type": "string",
      "description": "install, units roll kcp, serve gateway kcp: the unit name prefix of the installed application (a test placement; socialweb- when unset)",
      "env": "SOCIALWEB_UNIT_PREFIX"
    },
    "tls-front-address": {
      "type": "string",
      "description": "serve gateway kcp: listen address of the TLS front in front of the gateway's XRPC listener (an edge entry point; port 0 is read back into the Gateway status)",
      "env": "SOCIALWEB_TLS_FRONT_ADDRESS",
      "default": "127.0.0.1:0"
    },
    "cert-front-address": {
      "type": "string",
      "description": "serve gateway kcp: listen address of the client certificate front (an edge entry point; port 0 is read back into the Gateway status)",
      "env": "SOCIALWEB_CERT_FRONT_ADDRESS",
      "default": "127.0.0.1:0"
    },
    "tls-cert-file": {
      "type": "string",
      "description": "serve gateway kcp: the TLS front's certificate (with tls-key-file; unset, a self-signed one under <state>/tls); internal ingress-relay: serve TLS on --listen with this certificate (with tls-key-file; ignored with --unix-socket)",
      "env": "SOCIALWEB_TLS_CERT_FILE"
    },
    "tls-key-file": {
      "type": "string",
      "description": "serve gateway kcp: the TLS front's key (with tls-cert-file); internal ingress-relay: the key of tls-cert-file",
      "env": "SOCIALWEB_TLS_KEY_FILE"
    },
    "bidder-policy": {
      "type": "string",
      "description": "run bidder: the policy that gates which RFPs the bidder answers (MarketBidder spec.policy), for an installed bidder whose unit passes no hono-bidder options; a --policy after -- wins. Unset: bidder-tangled-vouch; open runs only when set explicitly. install bidder writes it to config.json (bidder-tangled-vouch unless this flag names another). dev up --profile market-network: the spec.policy of every network bidder (unset: bidder-tangled-vouch, the network composes the vouches its own requesters need)",
      "env": "SOCIALWEB_BIDDER_POLICY"
    },
    "bidder-policy-args": {
      "type": "string",
      "description": "run bidder: JSON arguments of bidder-policy (the hono-bidder policy-args option); a --policy-args after -- wins",
      "env": "SOCIALWEB_BIDDER_POLICY_ARGS"
    },
    "bidder-operator-signin": {
      "type": "string",
      "description": "run bidder: the handle or DID of the bidder operator's own account to sign in next to the bidder (the hono-bidder operator-signin option; plan 0039 D5): it composes the MarketIdentity operator (oauthQr, scope atproto and repo:sh.tangled.graph.vouch?action=create&action=update only), the AtprotoRepo operator and the ComponentLink link-records-operator, so examples/infra/vouch-bidder-operator.yaml applies in the bidder kcp. Unset: nothing of it is composed. install bidder writes it to config.json; an --operator-signin after -- wins",
      "env": "SOCIALWEB_BIDDER_OPERATOR_SIGNIN"
    },
    "bidder-options": {
      "type": "string",
      "description": "run bidder: hono-bidder options, written as after -- (for example \"--bid-ttl-sec 1800 --offering-refresh-sec 60\"), each an options entry of market-bidder in deploy/apps/option-map.yaml; they become MarketBidder spec.options and so the bidder component's argv. Set it in config.json of an installed bidder; an option after -- wins. Values are split on spaces: a value with a space goes in its own key (bidder-policy-args)",
      "env": "SOCIALWEB_BIDDER_OPTIONS"
    },
    "gateway-spec-file": {
      "type": "string",
      "description": "serve gateway kcp: a YAML GatewaySpec (network, bidderDids, options of the socialweb-computer-k8s web app, marketNetwork values, webAppFront) the Gateway root object is applied with; its profile is gateway-profile, and the PLC, the web app's gateway-audience and kcp-public-host default to SOCIALWEB_GATEWAY_PLC_URL, SOCIALWEB_GATEWAY_AUDIENCES and SOCIALWEB_GATEWAY_KCP_PUBLIC_HOST; webAppFront, the edge entry point caddy proxies to, defaults to 127.0.0.1:8788 in profile prod and 127.0.0.1:0 otherwise",
      "env": "SOCIALWEB_GATEWAY_SPEC_FILE"
    },
    "gateway-profile": {
      "type": "string",
      "description": "serve gateway kcp: the profile of the Gateway root object (prod or market-network)",
      "env": "SOCIALWEB_GATEWAY_PROFILE",
      "default": "prod"
    },
    "bootstrap-cluster": {
      "type": "string",
      "description": "serve gateway kcp: create this cluster (with its account and home workspaces) before the members start; unset creates none",
      "env": "SOCIALWEB_BOOTSTRAP_CLUSTER"
    },
    "bootstrap-account-did": {
      "type": "string",
      "description": "serve gateway kcp: the account DID of bootstrap-cluster (did:web:example.com when unset)",
      "env": "SOCIALWEB_BOOTSTRAP_ACCOUNT_DID"
    },
    "private-hostname": {
      "type": "string",
      "description": "internal ns-exec: the UTS hostname the command runs under, in its own user+UTS+mount namespace"
    },
    "bind": {
      "type": "string",
      "description": "internal ns-exec: comma-separated <source>:<target> directories bind-mounted in the command's mount namespace (a target that does not exist is skipped)"
    },
    "inside": {
      "type": "boolean",
      "description": "internal ns-exec: the second stage, already inside the namespaces unshare made"
    },
    "cluster-state-dir": {
      "type": "string",
      "description": "units roll cluster|link: the cluster provider's state dir, holding each cluster's controlplane.json",
      "env": "SOCIALWEB_CLUSTERPROVIDER_STATE_DIR"
    },
    "k3s-path": {
      "type": "string",
      "description": "Absolute path of the k3s executable (serve gateway kcp in a dev build: every tenant cluster's k3s, never PATH; a release build runs its embedded k3s; units roll cluster: the k3s the new slot runs, unset keeps the one the active slot runs)"
    },
    "dumbpipe-path": {
      "type": "string",
      "env": "SOCIALWEB_DUMBPIPE_PATH",
      "description": "units roll link: the dumbpipe executable the replacement listener runs (unset: the one the link runs); run request, dev up and run gateway ssh in a dev build: the dumbpipe executable that reaches guests over their iroh ticket (a release build runs its embedded dumbpipe); internal iroh-dial: the dumbpipe it runs per connection"
    },
    "service": {
      "type": "string",
      "description": "units roll link: the link to replace, apiserver or openbao"
    },
    "idle-bound": {
      "type": "string",
      "description": "units roll cluster: how long a swap waits for no non-kube-system pod Running on a market node before it proceeds anyway (Go duration)",
      "default": "30m"
    },
    "network": {
      "type": "string",
      "description": "run request, run requester and run bidder: the market network instance (dev up --profile market-network) whose MarketNetwork hosts this invocation or bidder as a child application; unset, a requester invocation is a standalone instance under <state-dir>/requests"
    },
    "market-network-file": {
      "type": "string",
      "description": "run bidder --profile market-network without --network (an installed bidder account joining a market network over the atproto market protocol only): a JSON file holding the MarketNetwork status (`dev status --instance <n> | jq .network.status`): its network value (with the CA bundle inline as PEM) and bidderPdsUrl",
      "env": "SOCIALWEB_MARKET_NETWORK_FILE"
    },
    "name": {
      "type": "string",
      "description": "run request: the invocation's name, a DNS label (default req-<UTC time>); release and resume take it as their argument. run requester: the requester's name, a DNS label (default requester), its state under <state-dir>/requesters/<name>; env, ssh, proxy and password take it as their argument. install requester: the requester instances, comma-separated (unit socialweb-computer-requester@<name>). run bidder --network: the bidder's application name in the market network, a DNS label (default from the handle)"
    },
    "identity": {
      "type": "string",
      "description": "run request: reuse one localRepo DID and repo across invocations from <state-root>/identities/<name>; standalone only, and the first run needs -- --skip-qr or an already-approved identity. Omit for a fresh DID per invocation"
    },
    "secrets": {
      "type": "string",
      "description": "run request: a secrets bundle file ([{\"path\": \"/abs/path\", \"value\": ...}]); it is written only into the invocation's own OpenBao, the guest fetches it at boot and it never enters a kcp object"
    },
    "agent": {
      "type": "string",
      "bare": "/etc/atirc/atirc.env",
      "description": "run request: --agent[=<envFile>] asks for an atirc agent on the guest (spec.agent; envFile default /etc/atirc/atirc.env): the bundle gets an ATIRC_TOKEN= entry at envFile (mode 0600, merged into --secrets or alone), the requester mints a long atirc token into it after the RFP, and run request agent <name> starts atirc-agent.service on the held guest; linux/amd64 guests only"
    },
    "guest-tools": {
      "type": "string",
      "description": "run request: guest tools the bidder installs on the guest (spec.guestTools, a comma list): socialweb-computer is the bidder's own running binary (linux/amd64 bidders only; a bidder on any other platform refuses the contract at provisioning), which setup-guest-binaries.service fetches from the bidder's GuestControlPlane at /v1/downloads/<sha256>/socialweb-computer-x86_64, checks against the sha256 the bidder pinned in user_data and installs as /usr/local/bin/socialweb-computer"
    },
    "associate": {
      "type": "string",
      "description": "run request and run request associate: the repo DID of a requester that the rented guest runs (spec.association.subject), or guest (spec.association.fromGuest: the DID the guest reports in a guest.requesterDid event): after the accept, or after that event, the requester writes a contract-scoped com.publicdomainrelay.temp.market.association record at rkey requester_associate-<did with : as -> in its own repo (contract = the market.accept, expiresAt = the accept time plus 24h), puts its at-uri#cid into the secrets bundle at /etc/socialweb-computer/association-ref and into status.association, and deletes it on release; run request associate <name> --associate <did> sets it on a running contract and prints the ref"
    },
    "association-ref": {
      "type": "string",
      "bare": "true",
      "description": "run request: --association-ref[=<at-uri>#<cid> or <file>] bootstraps the requester's association from one pinned record (spec.identity.associationRef): a market.association, a badgeBlueKeys claim or a post in the authority's repo that names this requester's DID for requester_associate; the MarketIdentity verifies it by one getRecord (cid, subject, service, expiresAt), mirrors it as the association proof and the invocation waits until it is verified. An absolute path reads the ref from that file; bare, it is /run/socialweb-r2/association-ref when the guest agent shares that dir (group socialweb-r2, which the agent user is in) and /etc/socialweb-computer/association-ref (root only) otherwise. A missing or empty file (the fromGuest case) makes this requester, once it has a DID, write the association request of association-request.json in the same dir (authority, contract, nonce) as a com.publicdomainrelay.temp.market.associationRequest record into its own repo, then its DID to requester-did there (/run/socialweb-guest-agent/requester-did in the root case), wait for the ref to arrive in the ref file and verify it; with r2-atirc.env there, its own agents' atirc tokens are minted below that token; standalone only"
    },
    "tunnel": {
      "type": "string",
      "description": "run request: guest tunnels to open, a comma list of <tag>:<port>[:<transport>][:shell[=<envFile>]] or <tag>:<port>:<envFile> (spec.tunnels; transport opentunnel, the default, or webrtc): opentunnel serves the guest's 127.0.0.1:<port> at an https URL that comes back in status.contract.networks, and webrtc bridges a datachannel to it; shell (opentunnel only) makes it a wootty browser shell, the fallback to ssh over webrtc, whose WOOTTY_AUTH_TOKEN (32 or more characters) the --secrets bundle writes to the envFile (default /etc/wootty/wootty.env)"
    },
    "transport": {
      "type": "string",
      "description": "run request, resume, ssh: how ssh reaches the guest: iroh (its iroh ticket) or webrtc (a datachannel to the --tag tunnel through run request proxy as the ProxyCommand; run request adds the tunnel <tag>:22:webrtc when the contract has none)",
      "default": "iroh"
    },
    "tag": {
      "type": "string",
      "description": "run request proxy, and ssh with --transport webrtc: the webrtc tunnel tag of the contract (spec.tunnels[].tag)",
      "default": "ssh"
    },
    "contract": {
      "type": "string",
      "description": "run request ssh and proxy: the ComputeContract to reach in the invocation's requester workspace, such as the one an EphemeralInfra contract made (its status.contracts[].computeContract); unset means the invocation's own contract"
    },
    "log-level": {
      "type": "string",
      "description": "run request proxy, and the proxy that run request, resume and ssh with --transport webrtc start as the ssh ProxyCommand: the level of its stderr log lines (debug, info, warn or error); warn keeps an interactive ssh over webrtc quiet, and its fatal error is one plain line",
      "default": "warn",
      "env": "SOCIALWEB_PROXY_LOG_LEVEL"
    },
    "hold": {
      "type": "boolean",
      "description": "run request, resume: keep the contract held when this process ends; its kcp stops and run request release|resume <name> starts it again from its state dir"
    },
    "exec": {
      "type": "string",
      "description": "run request, resume: run this program over ssh on the guest (StrictHostKeyChecking=yes against the host keys the guest reported) instead of an interactive session"
    },
    "r2-name": {
      "type": "string",
      "default": "r2",
      "description": "run request r2: the guest requester's invocation name inside the guest, a DNS label; run request r2 <name> [--agent] [--hold] publishes guest.r2Start on a held spec.association.fromGuest contract, and socialweb-guest-agent starts socialweb-r2.service, which runs run request --name <r2-name> --guest-requester as the r2 user (and run request agent <r2-name> once held, with --agent and --hold)"
    },
    "guest-requester": {
      "type": "boolean",
      "description": "run request, as the agent user inside a guest of a spec.association.fromGuest contract: run this requester as the guest requester in one command. It implies --association-ref (the shared /run/socialweb-r2 files the guest agent mirrors), --skip-ssh and its parent atirc token from /run/socialweb-r2/r2-atirc.env, (its token is only the parent for minting its own agents' tokens; it does not join the atirc channel itself); standalone only"
    },
    "skip-ssh": {
      "type": "boolean",
      "description": "run request, resume: do not open an ssh session once the guest is on the network"
    },
    "ready-file": {
      "type": "string",
      "description": "run requester: the ready file, written once the MarketRequester root is Ready and, with --with-gateway, its Gateway too (to <path>.tmp, then renamed; mode 0600) and rewritten on every restart and when one of its fields changes; removed on a clean stop. JSON {schema, name, pid, startedAt, kcpUrl, kubeconfig, workspace, did, handle, identityMode, pdsUrl, ingress {pds, requester}, sshPublicKey, gateway}: paths and public values only, never a token, key or password. <state-dir>/requesters/<name>/ready.json is always written; this names a second copy. run requester env|ssh|proxy read it (default that same path)"
    },
    "contract-timeout": {
      "type": "string",
      "description": "run request: how long the CLI waits for the contract to reach the guest's onNetwork and host keys, and for a release (Go duration)",
      "default": "3m"
    },
    "hostname": {
      "type": "string",
      "description": "internal ingress-relay: the relay's control host; its did:web is did:web:<hostname> and <did label>.<hostname> are its data hosts",
      "env": "SOCIALWEB_INGRESS_RELAY_HOSTNAME",
      "default": "xrpc.fedproxy.com"
    },
    "unix-socket": {
      "type": "string",
      "description": "internal ingress-relay: serve on this unix socket (mode 0755, an old socket file is replaced) instead of --listen (under 108 bytes)",
      "env": "SOCIALWEB_INGRESS_RELAY_UNIX_SOCKET"
    },
    "listen": {
      "type": "string",
      "description": "internal ingress-relay: the TCP listen address when --unix-socket is unset",
      "env": "SOCIALWEB_INGRESS_RELAY_LISTEN",
      "default": "127.0.0.1:8080"
    },
    "ingress-relay-service-id": {
      "type": "string",
      "description": "internal ingress-relay: the service id of the relay's did.json (#<id>, type XrpcRelay)",
      "env": "SOCIALWEB_INGRESS_RELAY_SERVICE_ID",
      "default": "xrpc_relay"
    },
    "ingress-relay-timeout": {
      "type": "string",
      "description": "internal ingress-relay: how long a forwarded request waits for its subscriber's response; a subscriber that answers nothing for this long is evicted (Go duration)",
      "env": "SOCIALWEB_INGRESS_RELAY_TIMEOUT",
      "default": "30s"
    },
    "ingress-relay-keepalive": {
      "type": "string",
      "description": "internal ingress-relay: how often each registered subscriber is probed with a keepalive request (Go duration)",
      "env": "SOCIALWEB_INGRESS_RELAY_KEEPALIVE",
      "default": "5s"
    },
    "ingress-relay-keepalive-timeout": {
      "type": "string",
      "description": "internal ingress-relay: how long a keepalive probe may take before its subscriber is evicted (Go duration)",
      "env": "SOCIALWEB_INGRESS_RELAY_KEEPALIVE_TIMEOUT",
      "default": "5s"
    },
    "ingress-relay-nonce-ttl": {
      "type": "string",
      "description": "internal ingress-relay: how long a registration nonce stays valid (Go duration)",
      "env": "SOCIALWEB_INGRESS_RELAY_NONCE_TTL",
      "default": "60s"
    },
    "ingress-relay-additional-hosts": {
      "type": "string",
      "description": "internal ingress-relay: comma-separated extra hosts accepted as control hosts and data host bases besides --hostname (127.0.0.1 is always one; * accepts every host)",
      "env": "SOCIALWEB_INGRESS_RELAY_ADDITIONAL_HOSTS"
    },
    "ingress-relay-allowed-dids": {
      "type": "string",
      "description": "internal ingress-relay: comma-separated DIDs allowed to register as subscribers (unset: every DID with a valid registration)",
      "env": "SOCIALWEB_INGRESS_RELAY_ALLOWED_DIDS"
    },
    "ingress-relay-plc-url": {
      "type": "string",
      "description": "internal ingress-relay: the PLC directory that resolves did:plc service-auth issuers and registration keys",
      "env": "SOCIALWEB_INGRESS_RELAY_PLC_URL",
      "default": "https://plc.directory"
    },
    "ingress-relay-max-body-mib": {
      "type": "number",
      "description": "internal ingress-relay: the largest forwarded request body in MiB; a larger one is answered 413",
      "env": "SOCIALWEB_INGRESS_RELAY_MAX_BODY_MIB",
      "default": 32
    },
    "ingress-relay-expire-sessions": {
      "type": "boolean",
      "description": "internal ingress-relay: close a subscriber's registration when its subscribe service-auth token expires, as the market network's IngressProxy does (unset: a registration lives as long as its websocket)",
      "env": "SOCIALWEB_INGRESS_RELAY_EXPIRE_SESSIONS"
    },
    "atproto-relay-listen": {
      "type": "string",
      "description": "internal atproto-relay: the TCP listen address of the atproto relay",
      "env": "SOCIALWEB_ATPROTO_RELAY_LISTEN",
      "default": "127.0.0.1:2584"
    },
    "atproto-relay-public-url": {
      "type": "string",
      "description": "internal atproto-relay: the relay's public origin (https://<host>); its host is the relay's did:web and describeServer did",
      "env": "SOCIALWEB_ATPROTO_RELAY_PUBLIC_URL"
    },
    "atproto-relay-plc-url": {
      "type": "string",
      "description": "internal atproto-relay: the PLC directory that resolves the signing keys of crawled repos",
      "env": "SOCIALWEB_ATPROTO_RELAY_PLC_URL",
      "default": "https://plc.directory"
    },
    "atproto-relay-allowed-hosts": {
      "type": "string",
      "description": "internal atproto-relay: comma-separated PDS hosts requestCrawl accepts, exact or *.<suffix> (unset or *: every host)",
      "env": "SOCIALWEB_ATPROTO_RELAY_ALLOWED_HOSTS"
    },
    "atproto-relay-seed-hosts": {
      "type": "string",
      "description": "internal atproto-relay: a listHosts answer ({hosts: [...]}) whose hosts the relay adds as idle known hosts at start (unset: <state-dir>/seed-hosts.json when it exists)",
      "env": "SOCIALWEB_ATPROTO_RELAY_SEED_HOSTS"
    },
    "atproto-relay-recrawl-window": {
      "type": "string",
      "description": "internal atproto-relay: at start the relay crawls again every known host that was active, and every idle host last seen within this window (Go duration; 0: active hosts only)",
      "env": "SOCIALWEB_ATPROTO_RELAY_RECRAWL_WINDOW",
      "default": "72h"
    },
    "atproto-relay-idle-after": {
      "type": "string",
      "description": "internal atproto-relay: a crawled host that fails to connect or drops at once for this long goes idle until its next requestCrawl (Go duration; 0: retry forever)",
      "env": "SOCIALWEB_ATPROTO_RELAY_IDLE_AFTER",
      "default": "1h"
    },
    "atproto-relay-max-backlog": {
      "type": "number",
      "description": "internal atproto-relay: the subscribeRepos frames kept in memory for cursor replay (and at most 64 MiB)",
      "env": "SOCIALWEB_ATPROTO_RELAY_MAX_BACKLOG",
      "default": 50000
    },
    "atproto-relay-start-seq": {
      "type": "number",
      "description": "internal atproto-relay: the lowest seq the relay's firehose continues from, so subscribers of a relay it replaces keep a valid cursor (the persisted seq wins when higher)",
      "env": "SOCIALWEB_ATPROTO_RELAY_START_SEQ",
      "default": 0
    },
    "atproto-relay-insecure-http": {
      "type": "boolean",
      "description": "internal atproto-relay: crawl PDS hosts over http and ws instead of https and wss (local runs only)",
      "env": "SOCIALWEB_ATPROTO_RELAY_INSECURE_HTTP"
    },
    "compute-kinds": {
      "type": "string",
      "description": "run bidder, install bidder and dev up --profile market-network: comma-separated compute kinds the bidder serves (vm, deno; spec.computeKinds of the MarketBidder, on every network bidder for dev up); unset, vm only; install bidder writes it to config.json. For run bidder without --network, no vm makes it a deno sandbox bidder, which needs --host-backend=proc and --fg"
    }
  }
}