Manifa

mani schema

mani schema prints a machine-readable description of the entire CLI as a single JSON object: every command, its parameters, its read/write scope, and its result shape, plus the full error-code taxonomy. It is the source of truth for scripting and automation — pipe it instead of scraping mani --help, and trust it over any prose (including these docs) whenever they disagree, because it is generated from the binary you actually installed.

Because the surface is self-describing, an agent or a script can discover what a build supports at runtime rather than hard-coding a list of verbs and flags that might drift.

Usage

mani schema

schema is a read_metadata command — it reads nothing secret and touches no account state, so it is always safe to run.

What it emits

Run it with the global --json flag to get the envelope (mani schema on its own prints the same payload, but --json is the form you script against):

mani --json schema
{
  "ok": true,
  "value": {
    "schema_version": 1,
    "verbs": [
      {
        "path": "vault share",
        "about": "Share a vault with another person in your organization",
        "scope": "share_or_revoke",
        "result": "The grantee email and the vault's key epoch after the grant.",
        "params": [
          { "name": "vault", "type": "string", "positional": true,  "required": true,  "help": "…", "possible_values": [] },
          { "name": "email", "type": "string", "positional": true,  "required": true,  "help": "…", "possible_values": [] },
          { "name": "role",  "type": "enum",   "positional": false, "required": false, "help": "…", "possible_values": ["read", "write", "admin"] }
        ]
      }
    ],
    "error_codes": [
      { "code": "invalid_args", "exit": 2 },
      { "code": "not_found",    "exit": 3 }
    ]
  }
}

The value object has three fields:

  • schema_version — an integer that bumps if the shape of this document changes, so a script can refuse to run against a shape it doesn't understand.
  • verbs — one entry per command. Each carries its canonical path (e.g. "vault share", "env pull", "account id"), a human about, its scope (see below), a result describing what a success returns, and its params (name, type, whether it's positional, whether it's required, help text, and any fixed possible_values for an enum flag).
  • error_codes — the closed taxonomy: every failure code and the process exit code it maps to. See JSON output & exit codes for the full table and how to branch on it.

Each verb's scope is one of read_metadata, read_plaintext, write, or share_or_revoke. It tells you what a command reads or mutates before you run it — a key input for automating mani safely.

Example: list every verb and its scope

mani --json schema | jq -r '.value.verbs[] | "\(.scope)\t\(.path)"'

Or pull just the commands that would reveal decrypted content:

mani --json schema | jq -r '.value.verbs[] | select(.scope == "read_plaintext") | .path'

See also