Module cli 

CLI definition: the five global args (defined exactly once, here) and the subcommand enum.

Placement rules (Phase 1 research, Pattern 1):

• Globals set the global arg attribute so they propagate to every subcommand; subcommand structs never redeclare them.
• Never mark a global arg required (clap rejects required globals).
• Flags-only, zero interactive prompts — ever (research anti-pattern: “Prompting ever”).

Structs

ApiArgs

ign api args (09-03, EXT-01) — the raw-passthrough family. One verb today (call); the escape hatch for the 80+ gateway endpoint families no curated command covers.

ApiCallArgs

ign api call args (09-03, EXT-01). Arbitrary verbs accepted — reqwest’s Method parser validates (usage-class refusal for garbage); --data is RAW TEXT on ANY method (GET/DELETE bodies allowed — curl parity; the gateway’s answer classifies); ONE query mechanism (repeatable --query k=v, never ? in --path).

BackupArgs

Backup subcommands (07-02, BKUP-01) — the standalone surface of the Phase 4 gwbk wire. restore is the family’s destructive verb (the 8th --yes-guarded set member: it REPLACES this gateway’s state); download is a streamed read, unguarded.

Cli

DiagnosticsArgs

ign diagnostics args (09-05, EXT-02) — the support-bundle family: bundle nests one level (the tags provider grouped- subfamily pattern).

EamArgs

EAM subcommands (07-02, BKUP-02) — the read-heavy surface with guarded writes. Every runtime verb honestly reports the controller-mode state gate (eam_not_controller on a stock gateway — the README documents the manual flip).

EditArgs

ign edit args (13-08): the kubectl-edit loop over ONE resource. The resource path scopes what $EDITOR opens (the whole tree still decodes for encode-back context); the push rides the project-import wire behind the ONE confirmation gate. --yes is the GLOBAL flag (globals-once) — never redeclared here.

GanArgs

ign gan args (09-04, EXT-02) — the Gateway Area Network morning-check family.

LicenseArgs

ign license args (09-04, EXT-02) — the license morning-check family. One verb today; room to grow (the uniform-leaf shape).

LintArgs

ign lint args (07-04, INTR-02) — the ignition-lint delegation: PATHS map to --target <path> pairs on the child’s arg vector; -- passthrough args ride verbatim after them (power users: --profile, --checks, --fail-on, …).

LoggersArgs

LogsArgs

Logs args: the query filters ride the TOP level so bare ign logs [-f] lists/tails (must-have truth #1) while download and the loggers subtree hang off the optional subcommand — the SessionsArgs precedent.

McpArgs

Hidden args for ign mcp serve (14-01). serve is a RESTRICTED POSITIONAL — not a subcommand — so the clap walk (tui_coverage.rs) yields exactly ONE row-requiring node, mcp itself: an mcp serve subcommand leaf would need a second routes() row and extend the pinned OutOfBand set past its four-member contract (an orphan row fails the walk by design). clap’s value_parser = ["serve"] keeps every other spelling (ign mcp, ign mcp bogus) a usage-class clap error — exit 2 BEFORE any protocol byte is written. Zero stdout-facing behavior here — the mode owns its own I/O entirely (mcp::serve).

ProfileArgs

Profile subcommands (nested: a struct wrapper carrying the subcommand enum, so Commands::Profile gets an Args payload).

ProjectArgs

Project subcommands (03-01, PROJ-01/02). delete is the family’s ONE destructive verb (--yes-guarded, exit 2 without); copy/ rename/set create or relabel — never destroy — so they carry NO guard (planner decision per research).

RedundancyArgs

ign redundancy args (09-04, EXT-02) — the redundancy morning-check family.

ResourceArgs

Resource subcommands (03-03, PROJ-05). delete is the family’s destructive verb (--yes-guarded, exit 2 without — the sessions-terminate shape); put is an upsert (create-or-replace ONE resource with explicit content) and stays friction-free per the planner decision — agents pass exactly what they want written.

RigArgs

Rig args (04-01, RIG-01): --rig rides the TOP level (the SessionsArgs --type precedent) so every rig verb shares it. The command enum carries ONLY the wired verbs — later plans extend it one variant at a time (the established extend-per-plan chore; no unimplemented!() stubs, every commit compiles clippy-clean).

ScriptArgs

Script subcommands (07-03, SCRPT-01) — the smallest family: ONE verb over the already-shipped, already-secured scriptExec route. script requires a subcommand (the rig trial shape — no bare row); the opt-in is STRUCTURAL (the route deploys only via ign webdev deploy --with-script-exec, which persists the secret at 0600), so run carries NO --yes guard by design — the deploy flag IS the opt-in and agents need the verb non-interactive (the research-adopted decision).

SessionsArgs

Sessions args: the family filter rides the TOP level so bare ign sessions [--type X] lists (must-have truth #1) while ign sessions terminate … carries the destructive half.

TagsArgs

Tags args (05-04, TAGS-01..04) — the grouped-subfamily pattern: tags provider … nests one level deeper (the family’s native REST half), browse/read/write ride the TOP level. The webdev-dependent arms carry --project (default ign-cli, the same default as deploy — the deployed routes live in that project).

TrialArgs

Trial subcommands (04-03, RIG-02/03). status reads the unauthenticated trial endpoint + banners cross-check. reset is the family’s destructive verb (--yes-guarded, exit 2 without — the reset precedent); the password NEVER rides a flag (env/secret only — redaction discipline).

WaitArgs

Wait targets (02-05, HLTH-11). gateway and restart poll the UNAUTHENTICATED /StatusPing (the dispatch builds a header-less client for them — waiting must work when auth is broken); module is an authed read.

WebdevArgs

Webdev subcommands (05-03, WEB-01/02). Deploy is deliberately NOT --yes-guarded: the dedicated project (default ign-cli) is CLI-OWNED — born from the first deploy zip and overwrite-replaced on every deploy (replace-not-merge is the CONTRACT here; user projects are never touched — README documents). scriptExec rides only on explicit request, gated by a deploy-time generated shared secret stored in the profile config at 0600.

WorkspaceArgs

Workspace subcommands (13-07): the local edit loop. checkout writes the mapped tree + records .ign-workspace.json (the manifest IS the workspace identity — status/push read it and the user never re-types the project); status reports PUSH-RELATIVE drift (every row says what push would do); push is the guarded splice of local edits into a FRESH gateway export.

Enums

ApiCommand

BackupCommand

BundleCommand

The four bundle verbs (09-05). Nothing here is destructive: generate creates a support bundle, download writes a local file, wait polls — none carry --yes (the backup-download posture).

CliBackupType

CLI value-enum mirror of the core BackupType (ignition-core stays clap-free; From converts at the dispatch seam).

CollisionPolicy

Import collision policy (03-02). Exactly the two values REST exposes — merge is the Designer import popup’s vocabulary and is NOT a value: clap’s invalid-value error lists the two real choices, and the README documents merge as Designer-only (the sanctioned rejection-with-hint shape).

Commands

ConnectionType

DiagnosticsCommand

EamCommand

EamTaskCommand

eam task … — the guarded writes (07-02 Task 3; the five lifecycle/mutation verbs arrive 10-04). new carries the typed guard ladder (backup+OnDemand unguarded; mutating types and any non-OnDemand schedule need –yes; restore/install/upgrade types refuse outright — see README); force dispatches NOW, always guarded; suspend/resume/cancel/modify/delete are the two-tier guarded verbs (pure precheck → blast-radius preview fetch → confirm-with-preview → action — the refusal message IS the blast radius).

GanCommand

LicenseCommand

LogLevel

The seven spec-documented log levels (TRACE..OFF), value-enum form for clap; LogLevel::wire yields the uppercase wire token.

LoggersCmd

LogsCmd

ProfileCmd

ProjectCommand

RedundancyCommand

ResourceCommand

RigCommand

ScheduleMode

Schedule modes (the openapi taxonomy’s user-facing subset — SuspendedByFailover is system-owned, not a CLI value).

ScriptCommand

SessionType

CLI value-enum mirrors of the core action enums (ignition-core stays clap-free; From converts at the dispatch seam).

SessionsCmd

TagsAlarmsCommand

tags alarms … — the alarm subfamily (05-06, TAGS-07). History needs a JOURNAL-PROVISIONED gateway (database connection + alarm-journal profile + general-alarm-settings — default rigs refuse exit 6 with the provisioning hint); acknowledge is the gateway-scope 3-arg form, so --username is REQUIRED (no default-guessing) and ack is deliberately NOT --yes-guarded (acknowledging never un-acknowledges anything — a state-advancing read-adjacent verb).

TagsCommand

TagsConfigCommand

tags config … — the configuration CRUD subfamily (05-05, TAGS-05): the get→edit-file→write-back surgical loop. Definition files are the configure shape (README’s traps table: tagType discriminator, nested children, alarms-as-LIST).

TagsHistoryCommand

tags history … — the historian subfamily (05-06, TAGS-08).

TagsProviderCommand

TagsUdtCommand

tags udt … — the UDT subfamily (05-05, TAGS-06).

TransferFormat

The bulk-transfer payload format (11-05) — the clap surface for core’s ExportFormat/ImportFormat (core keeps plain enums; the From impls live beside this one, the CollisionPolicy precedent). json is the default so every pre-11-05 invocation parses and behaves byte-identically.

TrialCommand

WaitCmd

WebdevCommand

WorkspaceCommand