weave-loom · cli

#[derive(Debug, Parser)]
#[command(
    name = "loom",
    about = "git-compatible VCS over Weave (Strand-backed, multi-device, signed)",
    version,
    author,
    long_about = "Loom is a git-compatible CLI whose repository is a signed, \
                  causal, multi-device store built on Weave (Strand + Locus + \
                  Lens + DHT). Agents fluent in git can use loom unchanged; \
                  the system handles signing, replication, and causal merge."
)]
pub struct Cli {
/// Subcommand to execute

#[command(subcommand)]
pub command: Command
}

#[derive(Debug, Subcommand)]
pub enum Command {
    /// Create an empty loom repository or reinitialize an existing one.
    Init(InitArgs),

    /// Show the working tree status.
    Status(StatusArgs),

    /// Add file contents to the index (staging area).
    Add(AddArgs),

    /// Record changes to the repository.
    Commit(CommitArgs),

    /// Show commit logs.
    Log(LogArgs),

    /// Show changes between commits, commit and working tree, etc.
    Diff(DiffArgs),

    /// Show various types of objects (commits, blobs).
    Show(ShowArgs),

    /// List, create, or delete branches.
    Branch(BranchArgs),

    /// Switch branches or restore working tree files (legacy git verb).
    Checkout(CheckoutArgs),

    /// Switch branches.
    Switch(SwitchArgs),

    /// Join two or more development histories together.
    Merge(MergeArgs),

    /// Reset current HEAD to a specified state.
    Reset(ResetArgs),

    /// Restore working tree files from a commit.
    Restore(RestoreArgs),

    /// Remove files from the working tree and index.
    Rm(RmArgs),

    /// Move or rename a file, directory, or symlink.
    Mv(MvArgs),

    /// Create, list, or delete tags.
    Tag(TagArgs),

    /// Manage tracked remotes (peers).
    Remote(RemoteArgs),

    /// Clone a repository from a peer or DID into a new directory.
    Clone(CloneArgs),

    /// Update remote refs along with associated objects.
    Push(PushArgs),

    /// Fetch from and integrate with another repository or local branch.
    Pull(PullArgs),

    /// Download objects and refs from another repository.
    Fetch(FetchArgs),

    /// Get and set repository or global options.
    Config(ConfigArgs),

    /// Manage signing identity (DID) for the agent.
    Identity(IdentityArgs),

    /// Manage private repository access and wrapped encryption keys.
    Access(AccessArgs),

    /// Run a long-lived peer presence so other devices can replicate.
    Daemon(DaemonArgs),

    /// Publish this repo to the local registry so peers can discover it.
    Register(RegisterArgs),

    /// Remove a repo from the local registry.
    Unregister(UnregisterArgs),

    /// Search the local registry by repo-name prefix.
    Search(SearchArgs),

    /// List every repo in the local registry.
    List(ListArgs),

    /// Run the local HTTP gateway so a browser/UI can read this repo.
    Serve(ServeArgs),

    /// Import a git repository's history into this loom repo.
    ImportGit(crate::commands::import_git::ImportGitArgs),

    /// Export this loom repo's history into a fresh git repository.
    ExportGit(crate::commands::export_git::ExportGitArgs),

    /// Pull request flow (open / list / show / approve / merge).
    Pr(crate::commands::pr::PrArgs),

    /// Issue, list, and revoke ACL mandates on this repository.
    Mandate(crate::commands::mandate::MandateArgs),

    /// MARS asset registration (canonical naming layer).
    Mars(crate::commands::mars::MarsArgs),

    /// Mint a deploy intent for the Sigil compute marketplace.
    Deploy(crate::commands::deploy::DeployArgs),
}

#[derive(Debug, clap::Args)]
pub struct ServeArgs {
/// Port to bind on (default 7740).

#[arg(short = 'p', long, default_value_t = 7740)]
pub port: u16,
/// Address to bind on (default 127.0.0.1).

#[arg(long, default_value = "127.0.0.1")]
pub host: String,
/// Explicitly permit a non-loopback bind. Bearer authentication remains

/// mandatory on every route.

#[arg(long)]
pub allow_remote: bool
}

#[derive(Debug, clap::Args)]
pub struct RegisterArgs {
/// Local repo name to publish (defaults to the workdir basename).

pub name: Option<String>,
/// Optional one-line description.

#[arg(short, long)]
pub description: Option<String>
}

#[derive(Debug, clap::Args)]
pub struct UnregisterArgs {
/// Repo name to remove from the registry.

pub name: String
}

#[derive(Debug, clap::Args)]
pub struct SearchArgs {
/// Optional name prefix; omit to list everything.

pub query: Option<String>
}

#[derive(Debug, clap::Args)]
pub struct ListArgs {
/// Render full registry entries as JSON instead of a table.

#[arg(long)]
pub json: bool
}

#[derive(Debug, clap::Args)]
pub struct DaemonArgs {
/// Optional duration in seconds to run before exiting (0 = forever).

#[arg(long, default_value_t = 0)]
pub duration: u64,
/// Re-announce resources on this interval (seconds).

#[arg(long, default_value_t = 30)]
pub announce_interval: u64
}

#[derive(Debug, clap::Args)]
pub struct InitArgs {
/// Directory to initialize (defaults to current directory).

pub directory: Option<PathBuf>,
/// Initial branch name.

#[arg(short = 'b', long, default_value = "main")]
pub initial_branch: String,
/// Force re-initialization if a `.loom/` directory already exists.

#[arg(long)]
pub force: bool,
/// Bind a specific signing identity (agent DID); defaults to the

/// repository-local generated identity.

#[arg(long)]
pub agent: Option<String>,
/// Encrypt blobs at rest with a per-repo MEK derived from the agent

/// identity. Plaintext bytes never touch the locus or the wire.

#[arg(long)]
pub private: bool
}

#[derive(Debug, clap::Args)]
pub struct StatusArgs {
/// Show short-form output.

#[arg(short, long)]
pub short: bool
}

#[derive(Debug, clap::Args)]
pub struct AddArgs {
/// Paths to stage.

#[arg(required = true)]
pub paths: Vec<PathBuf>
}

#[derive(Debug, clap::Args)]
pub struct CommitArgs {
/// Commit message.

#[arg(short, long)]
pub message: Option<String>,
/// Stage all tracked, modified files before committing.

#[arg(short = 'a', long)]
pub all: bool,
/// Override the author DID for this commit (defaults to repo identity).

#[arg(long)]
pub author: Option<String>,
/// Allow an empty commit (no changes).

#[arg(long)]
pub allow_empty: bool
}

#[derive(Debug, clap::Args)]
pub struct LogArgs {
/// Limit the number of commits to output.

#[arg(short = 'n', long)]
pub max_count: Option<usize>,
/// Use a single-line per commit format.

#[arg(long)]
pub oneline: bool,
/// Show the causal DAG (loom-specific; quiet upgrade over git's linear log).

#[arg(long)]
pub graph: bool,
/// Optional ref or commit to start from.

pub revision: Option<String>
}

#[derive(Debug, clap::Args)]
pub struct DiffArgs {
/// Restrict diff to these paths.

pub paths: Vec<PathBuf>,
/// Show a diff between two refs (`A..B`) or against the index.

#[arg(long)]
pub cached: bool,
/// Print only the per-path A/M/D summary (suppress line-level diff).

#[arg(long = "name-status")]
pub name_status: bool,
/// Number of context lines around each hunk (defaults to 3).

#[arg(short = 'U', long = "unified", default_value_t = 3)]
pub unified: usize
}

#[derive(Debug, clap::Args)]
pub struct ShowArgs {
/// Object to show (commit hash, tag, branch — defaults to HEAD).

pub object: Option<String>
}

#[derive(Debug, clap::Args)]
pub struct BranchArgs {
/// Branch to create or operate on.

pub branch: Option<String>,
/// Starting point for a new branch.

pub start_point: Option<String>,
/// Delete the named branch.

#[arg(short = 'd', long)]
pub delete: bool,
/// List all branches.

#[arg(short = 'l', long)]
pub list: bool
}

#[derive(Debug, clap::Args)]
pub struct CheckoutArgs {
/// Target branch or commit.

pub target: String,
/// Create a new branch and switch to it.

#[arg(short = 'b', long)]
pub create: bool
}

#[derive(Debug, clap::Args)]
pub struct SwitchArgs {
/// Target branch.

pub target: String,
/// Create the branch if it does not exist.

#[arg(short = 'c', long)]
pub create: bool
}

#[derive(Debug, clap::Args)]
pub struct MergeArgs {
/// Branch or commit to merge.

pub source: String,
/// Override the merge commit message.

#[arg(short, long)]
pub message: Option<String>
}

#[derive(Debug, clap::Args)]
pub struct ResetArgs {
/// Target commit (defaults to HEAD).

pub target: Option<String>,
/// Reset both index and working tree.

#[arg(long)]
pub hard: bool,
/// Reset only the index.

#[arg(long)]
pub mixed: bool,
/// Reset HEAD only (leave index/working tree intact).

#[arg(long)]
pub soft: bool
}

#[derive(Debug, clap::Args)]
pub struct RestoreArgs {
/// Files to restore.

#[arg(required = true)]
pub paths: Vec<PathBuf>,
/// Restore from the staged contents (index).

#[arg(long)]
pub staged: bool,
/// Source commit to restore from.

#[arg(long)]
pub source: Option<String>
}

#[derive(Debug, clap::Args)]
pub struct RmArgs {
/// Paths to remove.

#[arg(required = true)]
pub paths: Vec<PathBuf>,
/// Recursively remove directories.

#[arg(short, long)]
pub recursive: bool,
/// Only remove from the index, leave the working tree alone.

#[arg(long)]
pub cached: bool
}

#[derive(Debug, clap::Args)]
pub struct MvArgs {
/// Source path.

pub source: PathBuf,
/// Destination path.

pub destination: PathBuf
}

#[derive(Debug, clap::Args)]
pub struct TagArgs {
/// Tag name (omit to list).

pub name: Option<String>,
/// Commit the tag points at (defaults to HEAD).

pub target: Option<String>,
/// Delete the named tag.

#[arg(short = 'd', long)]
pub delete: bool
}

#[derive(Debug, clap::Args)]
pub struct RemoteArgs {
/// Subcommand: `add <name> <addr>`, `remove <name>`, `list`.

#[command(subcommand)]
pub action: RemoteAction
}

#[derive(Debug, Subcommand)]
pub enum RemoteAction {
    /// List configured remotes.
    List,

    /// Add a new remote.
    Add {
        /// Remote name.
        name: String,
        /// Remote address: a peer DID, multiaddr, or `did:weave:` URI.
        address: String,
    },

    /// Remove a remote.
    Remove {
        /// Remote name.
        name: String,
    },
}

#[derive(Debug, clap::Args)]
pub struct CloneArgs {
/// Source DID, multiaddr, or `did:weave:` URI (next-iteration form).

/// Optional today — when `--pubkeys` is given, this is unused.

#[arg(long)]
pub source: Option<String>,
/// Local directory to clone into. Defaults to a name derived from

/// the bundle's `repo_id`.

pub directory: Option<PathBuf>,
/// Branch to check out after cloning.

#[arg(short, long)]
pub branch: Option<String>,
/// Path to a JSON file produced by `loom identity share`.

/// Bootstraps the receiver with the source's resource pubkeys so

/// the four read-only handles can replicate over the DHT.

#[arg(long)]
pub pubkeys: Option<PathBuf>,
/// Path to a local Weave signing identity directory or identity.json.

/// Required for private clones so the peer can prove the granted DID.

#[arg(long)]
pub identity: Option<PathBuf>,
/// Path to a local encryption identity JSON whose public key matches

/// the private share bundle recipient.

#[arg(long = "encryption-identity")]
pub encryption_identity: Option<PathBuf>,
/// Expected repository-owner authentication public key as 32-byte hex.

/// Required for private clones to pin the out-of-band invite trust root.

#[arg(long = "owner-auth-key")]
pub owner_auth_key: Option<String>,
/// Expected current access-manifest signer authentication key as

/// 32-byte hex. Required, in addition to --owner-auth-key, when a

/// recovery admin signed the invite after owner-device replacement.

#[arg(long = "manifest-signer-auth-key")]
pub manifest_signer_auth_key: Option<String>,
/// Expected complete signed access-manifest hash as 32-byte hex.

/// Required for private first contact and obtained independently from the

/// bundle, so retirement authority history cannot authenticate itself.

#[arg(long = "manifest-hash")]
pub manifest_hash: Option<String>
}

#[derive(Debug, clap::Args)]
pub struct PushArgs {
/// Remote name (defaults to `origin`).

pub remote: Option<String>,
/// Refspec to push.

pub refspec: Option<String>
}

#[derive(Debug, clap::Args)]
pub struct PullArgs {
/// Remote name.

pub remote: Option<String>,
/// Branch to pull.

pub branch: Option<String>
}

#[derive(Debug, clap::Args)]
pub struct FetchArgs {
/// Remote name.

pub remote: Option<String>
}

#[derive(Debug, clap::Args)]
pub struct ConfigArgs {
/// Get a value (e.g. `user.name`).

#[arg(long, conflicts_with = "set")]
pub get: Option<String>,
/// Set a value (`key=value`).

#[arg(long)]
pub set: Option<String>,
/// List all configured values.

#[arg(short, long)]
pub list: bool
}

#[derive(Debug, clap::Args)]
pub struct IdentityArgs {
/// Subcommand.

#[command(subcommand)]
pub action: IdentityAction
}

#[derive(Debug, Subcommand)]
pub enum IdentityAction {
    /// Show the current signing identity DID.
    Show,
    /// Generate a new signing identity for this repository.
    Create,
    /// Bind a different DID as the repo's signing identity.
    Bind {
        /// Agent DID to bind.
        agent: String,
    },
    /// Print this repo's seven resource pubkeys as JSON, suitable for
    /// `loom clone --pubkeys` on a remote receiver.
    Share {
        /// Optional output file (defaults to stdout).
        #[arg(short, long)]
        output: Option<PathBuf>,
        /// Authorized recipient DID for private-repo access material.
        #[arg(long)]
        recipient_did: Option<String>,
        /// Authorized recipient encryption public key as 32-byte hex.
        #[arg(long = "recipient-enc-key")]
        recipient_enc_key: Option<String>,
    },
}

#[derive(Debug, clap::Args)]
pub struct AccessArgs {
/// Subcommand.

#[command(subcommand)]
pub action: AccessAction
}

#[derive(Debug, Subcommand)]
pub enum AccessAction {
    /// Generate recipient device keys before repository admission.
    EnrollmentKey {
        /// Repository id supplied by the inviting admin.
        #[arg(long)]
        repo_id: String,
        /// Assigned DID. Omit for a newly generated agent DID; provide the
        /// existing DID for compromised-device replacement.
        #[arg(long)]
        did: Option<String>,
        /// Writer device generation. Use 1 for a new member and the next
        /// generation reported by the admin for device replacement.
        #[arg(long, default_value_t = 1)]
        generation: u64,
        /// New empty directory in which owner-only identity files are stored.
        #[arg(long)]
        output: PathBuf,
        /// Render the public enrollment request as JSON.
        #[arg(long)]
        json: bool,
    },

    /// Print this repo's local encryption public key.
    Key {
        /// Render as JSON.
        #[arg(long)]
        json: bool,
    },

    /// List access manifest members.
    List {
        /// Render as JSON.
        #[arg(long)]
        json: bool,
    },

    /// Grant a DID reader, writer, or admin access.
    Grant {
        /// Human or agent DID to grant.
        #[arg(long)]
        did: String,
        /// Role to grant: reader, writer, or admin.
        #[arg(long)]
        role: String,
        /// Recipient sealed-box encryption public key as 32-byte hex.
        #[arg(long = "enc-key")]
        enc_key: String,
        /// Recipient signing/authentication public key as 32-byte hex.
        #[arg(long = "auth-key")]
        auth_key: String,
        /// Recipient's unlinkable per-repository Strand public key as
        /// 32-byte hex. Required for writer and admin roles; omitted for
        /// readers.
        #[arg(long = "strand-key")]
        strand_key: Option<String>,
    },

    /// Permanently freeze the initial admin DID roster. Bootstrap exactly
    /// three or more independently controlled admins first. After this
    /// one-way transition no new admin DID can be granted.
    FreezeAdminRoster,

    /// Revoke a DID and rotate the future repository key epoch.
    Revoke {
        /// Human or agent DID to revoke.
        #[arg(long)]
        did: String,
        /// Signed, peer-produced writer-tail attestations. Writer/admin
        /// revocation requires a strict majority and at least two independent
        /// active admins to attest the same complete terminal checkpoint.
        #[arg(long = "tail-attestation")]
        tail_attestations: Vec<PathBuf>,
    },

    /// Replace an active member's compromised or lost device keys and rotate
    /// the future repository-key epoch. Must be signed by a different active
    /// admin when replacing the current device.
    ReplaceDevice {
        /// Member DID whose device keys are being replaced.
        #[arg(long)]
        did: String,
        /// Replacement sealed-box encryption public key as 32-byte hex.
        #[arg(long = "enc-key")]
        enc_key: String,
        /// Replacement authentication public key as 32-byte hex.
        #[arg(long = "auth-key")]
        auth_key: String,
        /// Replacement private Strand public key as 32-byte hex. Required
        /// for writer/admin members; omit for readers.
        #[arg(long = "strand-key")]
        strand_key: Option<String>,
        /// Signed, peer-produced writer-tail attestations. Writer/admin
        /// replacement requires a strict majority and at least two independent
        /// active admins to attest the same complete terminal checkpoint.
        #[arg(long = "tail-attestation")]
        tail_attestations: Vec<PathBuf>,
    },

    /// Sign this admin peer's verified view of a writer's terminal Strand.
    /// Exchange the resulting file directly with the revoking admin; no
    /// registry, coordinator, or centralized service is involved.
    AttestTail {
        /// Active writer/admin DID whose current generation is being retired.
        #[arg(long)]
        did: String,
        /// New output file. Existing files are never overwritten.
        #[arg(long)]
        output: PathBuf,
    },

    /// Rotate the future repository key epoch without changing members.
    Rotate,

    /// Apply a recipient-scoped signed membership/key update received
    /// directly from another repository peer.
    Apply {
        /// Path to the updated bundle produced by `loom identity share`.
        #[arg(long)]
        bundle: PathBuf,
        /// Separately verified current owner authentication key (32-byte hex).
        #[arg(long = "owner-auth-key")]
        owner_auth_key: String,
        /// Separately verified current manifest signer key (32-byte hex).
        /// Required when a recovery admin, rather than the owner, signed.
        #[arg(long = "manifest-signer-auth-key")]
        manifest_signer_auth_key: Option<String>,
    },
}