Tags: immutable named states with tag attestations, in views and on the wire, policy-governed, exported to Git (spec 0.6h) 132b884b9a8d

//! Tags (spec §10.1, §14.4): immutable named states. A tag is a `tags/<name>`

//! entry in the view pointing at a state object, plus a signed `tag`

//! attestation when the author has a key. A name is never reassigned; a

//! server refuses a second attestation for an existing tag name.

use super::*;

#[derive(Debug, Clone, PartialEq, Eq)]

pub struct TagInfo {

    pub name: String,

    pub state: ObjectRef,

    pub heads: Vec<ChangeHash>,

    pub message: String,

    /// The signer's identity name, when attested by a known key.

    pub signer: Option<String>,

}

impl Repo {

    fn tag_attest_path(&self, name: &str) -> PathBuf {

        self.oxy.join("attest").join("tags").join(name)

    }

    /// The attestation recorded for a tag, if any.

    pub fn tag_attest(&self, name: &str) -> Result<Option<(ObjectRef, SignedAttest)>> {

        match fs::read_to_string(self.tag_attest_path(name)) {

            Ok(h) => {

                let r = ObjectRef::from_hex(h.trim()).ok_or_else(|| RepoError::Msg("corrupt tag attestation pointer".into()))?;

                Ok(Some((r, SignedAttest { attest: self.store.get_attest(&r)?, sigs: self.store.signatures(&r)? })))

            }

            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),

            Err(e) => Err(e.into()),

        }

    }

    fn set_tag_attest(&self, name: &str, r: &ObjectRef) -> Result<()> {

        fs::create_dir_all(self.oxy.join("attest").join("tags"))?;

        write_atomic(&self.tag_attest_path(name), r.to_hex().as_bytes())

    }

    /// Create a tag named `name` for the state of `heads` (spec §10.1).

    pub fn tag_create(&self, name: &str, heads: &[ChangeHash], message: &str) -> Result<TagInfo> {

        crate::objects::validate_name(name).map_err(|e| RepoError::Msg(format!("tag name: {e}")))?;

        let (op_ref, op) = self.head_op()?;

        if op.view.tags.contains_key(name) {

            return fail(format!("tag {name:?} already exists; tags are immutable"));

        }

        let st = self.load_state(heads)?;

        let heads = st.maximal(heads);

        if heads.is_empty() {

            return fail("a tag needs at least one change");

        }

        let state = self.store.put_state(&StateObject::new(heads.clone()))?;

        let mut signer = None;

        if self.secret_key()?.is_some() {

            let sa = self.sign_attest(&Attest { repo: self.id()?, hlc: Hlc::now(), body: AttestBody::Tag { name: name.into(), state, message: message.into() } })?;

            let r = sa.attest.hash();

            self.set_tag_attest(name, &r)?;

            signer = sa.sigs.first().and_then(|s| self.store.get_identity(&s.key).ok()).map(|i| i.name);

        }

        let mut view = op.view.clone();

        view.tags.insert(name.into(), state);

        self.record_op(&[op_ref], &format!("oxy tag create {name}"), view)?;

        Ok(TagInfo { name: name.into(), state, heads, message: message.into(), signer })

    }

    /// Every tag, by name.

    pub fn tags(&self) -> Result<Vec<TagInfo>> {

        let view = self.view()?;

        let mut out = Vec::new();

        for (name, state) in &view.tags {

            let heads = self.store.get_state(state)?.heads;

            let (message, signer) = match self.tag_attest(name)? {

                Some((_, sa)) => {

                    let message = match &sa.attest.body {

                        AttestBody::Tag { message, .. } => message.clone(),

                        _ => String::new(),

                    };

                    (message, sa.sigs.first().and_then(|s| self.store.get_identity(&s.key).ok()).map(|i| i.name))

                }

                None => (String::new(), None),

            };

            out.push(TagInfo { name: name.clone(), state: *state, heads, message, signer });

        }

        Ok(out)

    }

    /// The heads a tag names, if it exists.

    pub fn tag_heads(&self, name: &str) -> Result<Option<Vec<ChangeHash>>> {

        match self.view()?.tags.get(name) {

            Some(st) => Ok(Some(self.store.get_state(st)?.heads)),

            None => Ok(None),

        }

    }

    /// Tags as `refs` reports them.

    pub(crate) fn tag_refs(&self) -> Result<Vec<crate::protocol::TagRef>> {

        let mut out = Vec::new();

        for t in self.tags()? {

            out.push(crate::protocol::TagRef { name: t.name.clone(), state: t.state, heads: t.heads, attestation: self.tag_attest(&t.name)?.map(|(_, a)| a) });

        }

        Ok(out)

    }

    /// Adopt a tag received from a remote or a push. Verifies the

    /// attestation when present (and requires one, by an authorized key,

    /// under a policy). An existing tag with a different state is refused.

    pub(crate) fn adopt_tag(&self, view: &mut View, t: &crate::protocol::TagRef, policy: Option<&crate::policy::Policy>) -> std::result::Result<(), String> {

        if let Some(existing) = view.tags.get(&t.name) {

            return if *existing == t.state { Ok(()) } else { Err(format!("tag {:?} already exists with a different state; tags are immutable", t.name)) };

        }

        let state = self.store.get_state(&t.state).map_err(|_| "tag state object is missing".to_string())?;

        for h in &state.heads {

            if !self.store.has(h) && !self.boundary().contains(h) {

                return Err(format!("tag {:?} names change {}, which is missing", t.name, h.short(12)));

            }

        }

        if let Some(sa) = &t.attestation {

            let AttestBody::Tag { name, state: st, .. } = &sa.attest.body else { return Err("tag attestation has the wrong kind".into()) };

            if *name != t.name || *st != t.state {

                return Err("tag attestation does not describe this tag".into());

            }

            if sa.attest.repo != self.id().map_err(|e| e.to_string())? {

                return Err("tag attestation is for a different repository".into());

            }

            let r = sa.attest.hash();

            let sig = sa.sigs.first().ok_or("tag attestation carries no signature")?;

            let id = self.store.get_identity(&sig.key).map_err(|_| format!("unknown key {}", sig.key.short(12)))?;

            verify_signature(&id, sig, Domain::Attest, &r).map_err(|e| e.to_string())?;

            if let Some(p) = policy {

                if !p.authorizes(&sig.key, &format!("tags/{}", t.name)) {

                    return Err(format!("key {} may not create tags/{} under this repository's policy", sig.key.short(12), t.name));

                }

            }

            let stored = self.store.put_attest(&sa.attest).map_err(|e| e.to_string())?;

            for s in &sa.sigs {

                self.store.put_signature(&stored, s).map_err(|e| e.to_string())?;

            }

            self.set_tag_attest(&t.name, &stored).map_err(|e| e.to_string())?;

        } else if policy.is_some() {

            return Err(format!("tag {:?} needs a signed attestation under this repository's policy", t.name));

        }

        view.tags.insert(t.name.clone(), t.state);

        Ok(())

    }

}

    /// An immutable named state (spec §10.1).

    Tag { name: String, state: ObjectRef, message: String },

            AttestBody::Tag { .. } => "tag",

            AttestBody::Tag { name, state, message } => {

                Value::map([(0, Value::Text(name.clone())), (1, Value::Bytes(state.0.to_vec())), (2, Value::Text(message.clone()))])

            }

            "tag" => AttestBody::Tag {

                name: text(field(b, 0, "name")?, "name")?.to_owned(),

                state: oref(field(b, 1, "state")?, "state")?,

                message: text(field(b, 2, "message")?, "message")?.to_owned(),

            },

        let t = Attest { repo: [1; 16], hlc: Hlc::default(), body: AttestBody::Tag { name: "v1".into(), state: ObjectRef([5; 32]), message: "release".into() } };

        assert_eq!(Attest::decode(&t.encode()).unwrap(), t);

        assert_eq!(t.kind(), "tag");

    /// `tags/<name>`: immutable states (spec §10.1).

    pub tags: BTreeMap<String, ObjectRef>,

            (4, Value::Array(self.tags.iter().map(|(n, st)| Value::Array(vec![Value::Text(n.clone()), Value::Bytes(st.0.to_vec())])).collect())),

        if let Some(ts) = m.get(&4) {

            for t in array(ts, "tags")? {

                let pair = array(t, "tag")?;

                if pair.len() != 2 {

                    return Err(ObjectError::Schema("tag: expected [name, state]".into()));

                }

                view.tags.insert(text(&pair[0], "tag name")?.to_owned(), oref(&pair[1], "tag state")?);

            }

        }

        view.tags.insert("v1".into(), ObjectRef([8; 32]));

/// What `refs` returns: every bookmark, every tag, and the current policy.

    pub tags: Vec<TagRef>,

/// A tag as a remote reports it (spec §10.1).

#[derive(Clone, Debug, PartialEq, Eq)]

pub struct TagRef {

    pub name: String,

    pub state: ObjectRef,

    pub heads: Vec<ChangeHash>,

    pub attestation: Option<SignedAttest>,

}

    /// Push changes, bookmark updates, new tags, and optionally a newer

    /// policy. The policy is applied first; a result named `policy` reports

    /// it, and each tag reports as `tags/<name>`.

    fn push(&self, bundle: Bundle, updates: Vec<RefUpdate>, policy: Option<SignedPolicy>, tags: Vec<TagRef>) -> Result<Vec<RefResult>>;

    fn push(&self, bundle: Bundle, updates: Vec<RefUpdate>, policy: Option<SignedPolicy>, tags: Vec<TagRef>) -> Result<Vec<RefResult>> {

        self.repo.receive_push(bundle, updates, policy, tags)

    fn push(&self, bundle: Bundle, updates: Vec<RefUpdate>, policy: Option<SignedPolicy>, tags: Vec<TagRef>) -> Result<Vec<RefResult>> {

        wire::decode_push_response(&self.call(true, "push", Some(&wire::encode_push(&bundle, &updates, policy.as_ref(), &tags)))?)

    fn tags_value(tags: &[TagRef]) -> Value {

        Value::Array(

            tags.iter()

                .map(|t| {

                    Value::map([

                        (0, Value::Text(t.name.clone())),

                        (1, Value::Bytes(t.state.0.to_vec())),

                        (2, hashes_value(&t.heads)),

                        (3, opt_attest_value(&t.attestation)),

                    ])

                })

                .collect(),

        )

    }

    fn tags_from(v: &Value) -> Result<Vec<TagRef>> {

        let mut out = Vec::new();

        for t in o::array(v, "tags")? {

            let tm = map(t, "tag")?;

            out.push(TagRef {

                name: o::text(field(tm, 0, "name")?, "name")?.to_owned(),

                state: o::oref(field(tm, 1, "state")?, "state")?,

                heads: hashes_from(field(tm, 2, "heads")?)?,

                attestation: opt_attest_from(field(tm, 3, "attestation")?)?,

            });

        }

        Ok(out)

    }

            (3, tags_value(&resp.tags)),

        let tags = match m.get(&3) {

            Some(t) => tags_from(t)?,

            None => Vec::new(),

        };

        Ok((id, RefsResponse { refs, policy, tags }))

    pub fn encode_push(bundle: &Bundle, updates: &[RefUpdate], policy: Option<&SignedPolicy>, tags: &[TagRef]) -> Vec<u8> {

            (3, tags_value(tags)),

    /// A decoded push: bundle, bookmark updates, policy, tags.

    pub type PushParts = (Bundle, Vec<RefUpdate>, Option<SignedPolicy>, Vec<TagRef>);

    pub fn decode_push(bytes: &[u8]) -> Result<PushParts> {

        let tags = match m.get(&3) {

            Some(t) => tags_from(t)?,

            None => Vec::new(),

        };

        Ok((bundle, updates, policy, tags))

        let tag = TagRef { name: "v1".into(), state: ObjectRef([2; 32]), heads: vec![c.hash()], attestation: None };

        let resp = RefsResponse { refs, policy: Some(SignedPolicy { policy: policy.clone(), sigs: vec![psig.clone()] }), tags: vec![tag.clone()] };

        assert_eq!(back.tags, vec![tag.clone()]);

        let (b2, ups, pol, tags) = wire::decode_push(&wire::encode_push(&bundle, std::slice::from_ref(&up), Some(&sp), std::slice::from_ref(&tag))).unwrap();

        assert_eq!(tags, vec![tag]);

        // Tags: their states and attestations.

        let view_now = self.view()?;

        states.extend(view_now.tags.values().copied());

        for name in view_now.tags.keys() {

            if let Some((r, _)) = self.tag_attest(name)? {

                attests.push(r);

            }

        }

        if let Some(m) = last_mark {

            stream.extend_from_slice(format!("reset refs/heads/{bookmark}\nfrom :{m}\n\n").as_bytes());

        // Tags: a tag whose state was exported as a bookmark state points at

        // that commit; otherwise its state gets a commit of its own.

        for t in self.tags()? {

            let mark = match marks.get(&t.state) {

                Some(m) => *m,

                None => {

                    let loaded = self.load_state(&t.heads)?;

                    let snapshot = loaded.materialize();

                    let mark = next_mark;

                    next_mark += 1;

                    let message = format!("oxy: tag {}\n\n{}Oxy-State: {}\n", t.name, if t.message.is_empty() { String::new() } else { format!("{}\n\n", t.message) }, t.state.to_hex());

                    self.write_commit(&mut stream, "refs/oxy/export", mark, "oxy <oxy@localhost>", Hlc::now().wall_ms / 1000, &message, &[], &snapshot)?;

                    marks.insert(t.state, mark);

                    report.exported += 1;

                    mark

                }

            };

            stream.extend_from_slice(format!("reset refs/tags/{}\nfrom :{mark}\n\n", t.name).as_bytes());

        }

        stream.extend_from_slice(b"done\n");

mod tags;

pub use tags::TagInfo;

    /// Resolve a spec to a set of heads: a tag name, the current bookmark's

    /// name, or a single change (`resolve_change`).

    pub fn resolve_heads(&self, spec: &str) -> Result<Vec<ChangeHash>> {

        if spec == self.config.bookmark {

            return self.bookmark_heads();

        }

        if let Some(heads) = self.tag_heads(spec)? {

            return Ok(heads);

        }

        Ok(vec![self.resolve_change(spec)?])

    }

    /// Tags adopted from the remote.

    pub new_tags: usize,

        Ok(RefsResponse { refs: out, policy: self.current_policy()?.map(|(_, sp)| sp), tags: self.tag_refs()? })

    pub fn receive_push(&self, bundle: Bundle, updates: Vec<RefUpdate>, policy: Option<SignedPolicy>, tags: Vec<crate::protocol::TagRef>) -> Result<Vec<RefResult>> {

        for t in &tags {

            let name = format!("tags/{}", t.name);

            match self.adopt_tag(&mut view, t, policy.as_ref()) {

                Ok(()) => {

                    names.push(name.clone());

                    results.push(RefResult { name, ok: true, reason: String::new() });

                }

                Err(e) => results.push(RefResult { name, ok: false, reason: e }),

            }

        }

        let mut new_tags = 0;

        for t in &resp.tags {

            if view.tags.contains_key(&t.name) {

                continue;

            }

            // The tag's changes must be here: fetch them if the bookmarks did not bring them.

            let missing: Vec<ChangeHash> = t.heads.iter().filter(|h| !self.store.has(h)).copied().collect();

            if !missing.is_empty() {

                let needed = remote.negotiate(&self.known_heads(&view)?, &missing)?;

                let bundle = remote.fetch(&needed, max_blob)?;

                self.import_bundle(&bundle, false)?;

            }

            self.store.put_state(&StateObject::new(t.heads.clone()))?;

            self.adopt_tag(&mut view, t, policy.as_ref()).map_err(|e| RepoError::Msg(format!("{remote_name} {}: {e}", t.name)))?;

            new_tags += 1;

        }

        Ok(FetchReport { refs: report, unverified, new_tags })

        let remote_tags: BTreeSet<String> = resp.tags.iter().map(|t| t.name.clone()).collect();

        let tags_to_send: Vec<crate::protocol::TagRef> = self.tag_refs()?.into_iter().filter(|t| !remote_tags.contains(&t.name)).collect();

        if new_state == remote_state && policy_to_send.is_none() && tags_to_send.is_empty() {

        // Tag states must be present on the remote: bundle their changes too.

        for t in &tags_to_send {

            let extra = self.negotiate(&remote_heads, &t.heads)?;

            let extra: Vec<ChangeHash> = extra.into_iter().filter(|h| !to_send.contains(h)).collect();

            if !extra.is_empty() {

                let more = self.bundle_for(&extra)?;

                bundle.changes.extend(more.changes);

                bundle.attests.extend(more.attests);

                bundle.objects.extend(more.objects);

            }

            bundle.objects.push((ObjectType::State, StateObject::new(t.heads.clone()).encode()));

        }

        let results = remote.push(bundle, vec![RefUpdate { name: bookmark.clone(), old_state: remote_state, new_state, force, attestation }], policy_to_send, tags_to_send)?;

    let r = origin.receive_push(Bundle::default(), vec![RefUpdate { name: "main".into(), old_state: s1, new_state: ghost, force: false, attestation: None }], None, vec![]).unwrap();

    let r = origin.receive_push(Bundle::default(), vec![RefUpdate { name: "main".into(), old_state: empty, new_state: s1, force: false, attestation: None }], None, vec![]).unwrap();

    let r = origin.receive_push(Bundle::default(), vec![RefUpdate { name: "main".into(), old_state: s1, new_state: empty, force: false, attestation: None }], None, vec![]).unwrap();

    let r = origin.receive_push(Bundle::default(), vec![RefUpdate { name: "main".into(), old_state: s1, new_state: empty, force: true, attestation: None }], None, vec![]).unwrap();

    let r = origin.receive_push(Bundle::default(), vec![RefUpdate { name: "main".into(), old_state: empty, new_state: s1, force: false, attestation: Some(sa.clone()) }], None, vec![]).unwrap();

    let r = origin.receive_push(Bundle::default(), vec![RefUpdate { name: "main".into(), old_state: empty, new_state: s1, force: false, attestation: Some(sa2) }], None, vec![]).unwrap();

    let r = origin.receive_push(Bundle::default(), vec![], Some(forged), vec![]).unwrap();

    let r = origin.receive_push(Bundle::default(), vec![], Some(old), vec![]).unwrap();

#[test]

fn tags_are_immutable_named_states_and_travel() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let origin = Repo::init(&root.join("origin")).unwrap();

    let url = root.join("origin").to_string_lossy().to_string();

    let mut a = Repo::clone(&url, &root.join("a")).unwrap().with_home(root.join("home-a"));

    let (key_a, _) = a.create_identity("Ada", "[email protected]", IdentityScope::User).unwrap();

    write(&root.join("a"), "f.txt", b"1\n");

    let h1 = a.commit("one", &[]).unwrap();

    write(&root.join("a"), "f.txt", b"1\n2\n");

    let h2 = a.commit("two", &[]).unwrap();

    let t = a.tag_create("v1", &[h1], "first release").unwrap();

    assert_eq!((t.heads.clone(), t.signer.as_deref()), (vec![h1], Some("Ada")));

    assert!(a.tag_create("v1", &[h2], "").is_err(), "immutable");

    assert!(a.tag_create("bad/name", &[h2], "").is_err());

    assert_eq!(a.tag_heads("v1").unwrap(), Some(vec![h1]));

    assert_eq!(a.resolve_heads("v1").unwrap(), vec![h1]);

    assert_eq!(a.resolve_heads("main").unwrap(), vec![h2]);

    let (_, sa) = a.tag_attest("v1").unwrap().unwrap();

    assert_eq!(sa.sigs[0].key, key_a);

    // Checkout by tag.

    a.checkout(&a.resolve_heads("v1").unwrap(), false, "co").unwrap();

    assert_eq!(fs::read(root.join("a/f.txt")).unwrap(), b"1\n");

    a.checkout(&a.bookmark_heads().unwrap(), false, "co").unwrap();

    // Push carries the tag; a second attestation for the name is refused.

    let r = a.push("origin", false).unwrap();

    assert!(r.iter().any(|x| x.name == "tags/v1" && x.ok), "{r:?}");

    assert_eq!(origin.tag_heads("v1").unwrap(), Some(vec![h1]));

    let mut forged = a.tag_refs().unwrap().into_iter().find(|t| t.name == "v1").unwrap();

    forged.state = origin.store().put_state(&StateObject::new(vec![h2])).unwrap();

    forged.heads = vec![h2];

    forged.attestation = None;

    let r = origin.receive_push(Bundle::default(), vec![], None, vec![forged]).unwrap();

    assert!(!r[0].ok && r[0].reason.contains("immutable"), "{r:?}");

    // A clone gets the tag; a later tag arrives on fetch.

    let b = Repo::clone(&url, &root.join("b")).unwrap().with_home(root.join("home-b"));

    assert_eq!(b.tag_heads("v1").unwrap(), Some(vec![h1]));

    assert!(b.tags().unwrap()[0].signer.as_deref() == Some("Ada"));

    a.tag_create("v2", &[h2], "second").unwrap();

    a.push("origin", false).unwrap();

    let rep = b.fetch("origin").unwrap();

    assert_eq!(rep.new_tags, 1);

    assert_eq!(b.tag_heads("v2").unwrap(), Some(vec![h2]));

    // Under a policy, an unattested tag is refused and an attested one by the root passes.

    a.policy_init().unwrap();

    a.push("origin", false).unwrap();

    let unattested = crate::protocol::TagRef { name: "v3".into(), state: origin.store().put_state(&StateObject::new(vec![h2])).unwrap(), heads: vec![h2], attestation: None };

    let r = origin.receive_push(Bundle::default(), vec![], None, vec![unattested]).unwrap();

    assert!(!r[0].ok && r[0].reason.contains("attestation"), "{r:?}");

    a.tag_create("v3", &[h2], "").unwrap();

    let r = a.push("origin", false).unwrap();

    assert!(r.iter().any(|x| x.name == "tags/v3" && x.ok), "{r:?}");

    assert!(a.gc(true).is_ok());

    assert_eq!(a.tags().unwrap().len(), 3, "tags survive gc");

}

        let (bundle, updates, policy, tags) = wire::decode_push(&body)?;

        Ok(ok(wire::encode_push_response(&r.receive_push(bundle, updates, policy, tags)?)))

| **Status** | Draft 0.6h |

| `View` (in `Op`) | Key 0 bookmarks: array of `[text name, bytes(32) state ref]` sorted by name; key 1 workspaces: array of `[bytes(16) id, bytes(32) change]` sorted by id; key 2 remotes: array of `[text remote, [[text bookmark, bytes(32) state ref]]]`; key 3 policy ref or null; key 4 tags: array of `[text name, bytes(32) state ref]`. Repository format 1 stored `[name, [heads]]`; format 2 stores the state ref. |

Tags are attestations of kind `tag` and are never updated; a server MUST reject a second attestation for an existing tag name, and any receiver MUST refuse a tag whose name it already holds with a different state. `oxy tag create NAME [CHANGE..]` tags the named state (default the bookmark's heads); tags travel with `refs` and `push` (§16.3), and a policy rule for `tags/<name>` governs who may create them.

| `refs` response | `{0: [{0: name, 1: state ref, 2: [heads], 3: signed attestation or null, 4: last serial or null}], 1: repo id, 2: signed policy or null, 3: [tag]}`; the attestation is present only when it describes the current state; a tag is `{0: name, 1: state ref, 2: [heads], 3: signed attestation or null}` |

| `push` request | `{0: Bundle, 1: [{0: name, 1: old state, 2: new state, 3: force, 4: signed attestation or null}], 2: signed policy or null, 3: [tag]}`; response `{0: [{0: name, 1: ok, 2: reason}]}`, where a result named `policy` reports the policy update and `tags/<name>` each tag |

*Changelog.* Draft 0.6h (2026-09-27): tags in views, on the wire, and under policy (§5.5, §10.2, §16.3).

Draft 0.6g (2026-09-27): shallow repositories as checkpoint plus history window, the `checkpoint` and `shallow` messages, deepening (§16.3, §17).

    /// Tags: immutable named states

    Tag {

        #[command(subcommand)]

        cmd: TagCmd,

    },

enum TagCmd {

    /// Tag the state of CHANGE... (default: the bookmark heads)

    Create {

        name: String,

        changes: Vec<String>,

        #[arg(short, long, default_value = "")]

        message: String,

    },

    List,

}

#[derive(Subcommand)]

        Cmd::Tag { cmd } => match cmd {

            TagCmd::Create { name, changes, message } => workspace::tag_create(&name, &changes, &message),

            TagCmd::List => workspace::tag_list(),

        },

    if report.new_tags > 0 {

        println!("{}", ui::dim(format!("{} adopted", plural(report.new_tags, "tag"))));

    }

        let mut heads = Vec::new();

        for c in changes {

            heads.extend(repo.resolve_heads(c)?);

        }

        heads

pub fn tag_create(name: &str, changes: &[String], message: &str) -> Result<i32> {

    let repo = open()?;

    repo.snapshot("oxy tag")?;

    let heads = if changes.is_empty() {

        repo.bookmark_heads()?

    } else {

        let mut heads = Vec::new();

        for c in changes {

            heads.extend(repo.resolve_heads(c)?);

        }

        heads

    };

    let t = repo.tag_create(name, &heads, message)?;

    println!(

        "{} {} -> {} ({}){}",

        ui::ok("Tagged"),

        ui::id(&t.name),

        ui::hash(format!("#{}", t.state.short(12))),

        plural(t.heads.len(), "head"),

        t.signer.map(|s| format!(", signed by {s}")).unwrap_or_else(|| ui::dim(", unsigned"))

    );

    Ok(0)

}

pub fn tag_list() -> Result<i32> {

    let repo = open()?;

    let tags = repo.tags()?;

    if tags.is_empty() {

        println!("{}", ui::dim("No tags."));

    }

    for t in tags {

        println!(

            "{} {} {}{}{}",

            ui::id(&t.name),

            ui::hash(format!("#{}", t.state.short(12))),

            ui::dim(format!("({})", plural(t.heads.len(), "head"))),

            if t.message.is_empty() { String::new() } else { format!("  {}", t.message.lines().next().unwrap_or("")) },

            t.signer.map(|s| ui::dim(format!("  [{s}]"))).unwrap_or_default()

        );

    }

    Ok(0)

}