Module projects 

Project actions (03-01, PROJ-01/02): list with inheritance info, new, copy, rename, set (reparent), delete — serde models OUT, no printing (ARCHITECTURE.md layering: the Phase-6 TUI rides this same layer).

03-02 (PROJ-03/04) adds export/import: the export result carries the static scope metadata (what a project ZIP does and does not contain — roadmap criterion 4), and the import action owns the collision policy — the abort pre-check refuses via project_find BEFORE any upload; overwrite skips the pre-check (the server is the authority) and dispatch guards it as destructive.

Two-column naming (LOCKED): client models stay wire-faithful; these action results re-expose the SELECTED fields under unit-explicit snake_case keys, ALL keys always present (null when absent) — the stable agent shape; agents must never key-hunt.

Every mutation READS BACK via project_find — the create/copy/ rename/modify response bodies are unverified LOW (the restart literal true precedent), so the record the gateway answers with IS the truth the CLI reports.

The parents/parents/{name} endpoints stay OUT of scope: the server is the reparent authority (cycle guard), and PROJ-01’s inheritance info comes from the list items themselves.

Structs

ExportDecodedResult

ign project export --decode-scripts output model (07-04, INTR-01): the DIRECTORY is the artifact — the export’s members plus <member>.<n>.py sidecars plus the pointer manifest, ready for nvim/ignition-lint editing.

ExportResult

ign project export output model: {project, file, bytes, scope} — the FILE is the artifact; stdout stays data-only.

ExportScope

The scope metadata carried in BOTH export and import JSON data — identical consts, so the statement “what this ZIP does and does not contain” never drifts between the two commands.

ImportResult

ign project import output model: {name, collision_policy, bytes, scope, outcome} — outcome is the opaque server answer (an object when JSON, else the success fallback).

NewOptions

project new flags — only provided fields ride the create body (absent = NOT SENT, Pitfall 5); enabled is the CLI --disabled flag inverted at the dispatch seam.

ProjectCopyResult

ign project copy output model: the source plus the destination’s read-back record (flat in JSON).

ProjectDeleteResult

ign project delete output model.

ProjectDiffResult

ign project diff output model — the flat agent shape, ALL keys always. scope is the literal "project" (the scope-honesty mandate: tag providers live on a different seam, README documents the promotion pipe); profile_a/profile_b ride the DATA while the envelope keeps its single active-profile field (the frozen one-field envelope).

ProjectMetaDelta

One project.json semantic-field difference — (field, a, b) surfaced as named keys (the flat agent shape).

ProjectRenameResult

ign project rename output model: previous name plus the renamed project’s read-back record (flat).

ProjectSetResult

ign project set output model: the read-back record (flat, the stable agent shape) plus which fields this set touched — display-only, serde-skipped so it NEVER appears in JSON.

ProjectSummary

One project row — the six fields PROJ-01 names.

ProjectSyncResult

ign project sync output model — the flat agent shape, ALL keys always (empty vecs when none). Direction is ALWAYS explicit A→B (source A, target B).

ProjectsResult

ign project list output model.

SetOptions

project set flags — ONLY the Some fields ride the modify body (absent flag = don’t touch — Pitfall 5’s modify half).

SyncSelection

What project sync promotes from A into B (07-01, SYNC-02) — at least one half is required (the CLI validates pre-resolution; the action re-validates for its other callers).

Enums

CollisionPolicy

The import collision policy. REST exposes exactly abort and overwrite — merge is the Designer import popup’s vocabulary and is rejected at the CLI value-enum level (README documents it as Designer-only).

Constants

EXPORT_EXCLUDES

What a project export EXCLUDES — tag providers, tags, and UDTs are GATEWAY CONFIGURATION, not project resources (the git-module convention keeps a separate tags/ tree precisely because of this).

EXPORT_INCLUDES

What a project export INCLUDES — the static, documented-once arrays (HIGH confidence: verified from a real git-module-managed 8.3 export tree). Data, not prose — agents key off them (roadmap criterion 4).

IMPORT_MAX_BYTES

Import sanity limit — 512 MB (a real project export is MB-scale; anything past this is a wrong file, not a project). Checked BEFORE any network I/O.

Functions

project_copy

ign project copy — copy all resources, then find(to) read-back.

project_delete

ign project delete — the obedient arm; the --yes guard belongs to the CLI CALLER (it refuses pre-resolution, the LOCKED 02-03 shape). The wire request always carries confirm=true.

project_diff

ign project diff A B --project NAME — export both sides (A first), run the normalized member compare plus the project.json meta delta. A missing project on either side surfaces through export’s existing not-found path; the same profile twice is a usage-class refusal (exit 2) before any network I/O.

project_export

ign project export — stream the project ZIP to disk. With -o the bytes land at exactly that path; without one, the stream goes to <name>.zip.part in the working directory and atomically renames to the SANITIZED Content-Disposition basename (path components stripped) or the <name>.zip fallback — the .part is removed best-effort on error, so a failed export leaves no half-written impostor.

project_export_decoded

ign project export NAME --decode-scripts — buffer the export (the diff/sync seam), then decode the tree via the PURE codec: members + counter-named sidecars + scripts-manifest.json at the directory root. The re-encode half (import --encode-scripts) lives at the CLI dispatch seam — it re-zips the directory BEFORE this action’s import path, which then rides verbatim (validate_import walks the re-zipped archive — the 05-07 guard applies free).

project_import

ign project import — order is the contract: magic/size guards (exit 2, zero network) → abort-policy find pre-check (Ok → CoreError::ProjectExists BEFORE any upload) → the raw-body upload with the policy as the wire’s overwrite query param. Overwrite runs NO pre-check — the server is the authority — and the CLI guards it as destructive upstream of this action.

project_new

ign project new — create, then find read-back (validates the create and fills the result; the create response body itself is unverified LOW).

project_rename

ign project rename — native rename, then find(new) read-back.

project_set

ign project set — build the modify body from Some-fields ONLY (absent flag = don’t touch), PUT, then read-back. --parent IS the inheritance move.

project_sync

ign project sync A B --project NAME — the guarded promotion. Order is the contract: export A then B → resolve the selection (explicit --resource paths must exist in A unless --delete wants them removed from B; --all_changed rides the diff) → splice A’s member bytes into B’s zip via the surgery helpers (replace_member’s descriptor-merge landing rules ride free — 05-07’s put-new hazard is handled) → optional remove_member passes for deletions → validate_import + ONE overwrite-import into B. B’s root project.json is never touched (only resource members splice). An EMPTY effective selection performs NO import (zero writes) and reports empty lists.

projects

ign project list — every runnable project with inheritance info (the standard limit=-1 UI convention).