Vaults and devices

Vaults

A vault is a synced root folder plus its full history — the unit of sharing and keying in Manifa. Every vault has its own random Vault Key (VK), wrapped to each member's Account Master Key. Create one with:

mani vault create my-project ~/code/my-project

A vault tracks a chain of snapshots — immutable, content-addressed commits of the whole tree — so "what does this vault look like" always has a precise answer. See the sync model for how snapshots advance.

Accounts vs. devices

Your account is one identity, one Account Master Key, and a set of enrolled devices — each device holds its own local keypair, generated on enrollment, whose private half never leaves it (kept in the OS keystore: Keychain on macOS, secret-service on Linux — see Platforms for OS-specific details). The AMK is wrapped separately to each device's public key, so any enrolled device can unwrap it independently.

This is also why Manifa has two separate secrets, and it's worth being explicit about why:

Login (email + one-time code, or Google) proves who you are to the server. It gates account access but the server can fully see and control it.
Master password wraps your Account Master Key and never reaches the server. It's the thing that actually makes your data unreadable to anyone but you.

Signing in does not, by itself, decrypt anything. See the zero-knowledge model for the full key hierarchy.

Enrollment

A fresh device gets access to your account via mani device enroll, in one of two ways:

Approval from an existing device — the new device requests access; an already-trusted device approves it and wraps the AMK to the new device's public key. No secrets are retyped.
Password + recovery code — used when this is the only device you have left (e.g. first re-install after losing everything else).

Once enrolled, a device can mani clone any vault it's been given access to.

Vaults are shared with people, not individual devices — you seal the Vault Key to a teammate's account identity key, and any device they enroll can then open it. Sharing is same-organization only, so the flow is:

Get them into your org. Invite by email; they accept:

mani org invite teammate@example.com
# they then run:  mani org invites   and   mani org accept <id>

Share the vault (admin-only). The Vault Key is unwrapped under your Account Master Key and re-sealed to the recipient's published identity key on your machine — the server only ever sees ciphertext:
```
mani vault share my-project teammate@example.com --role write
```
--role is read, write, or admin (default write). The first time you share with someone, mani prints their key fingerprint — confirm it against what they read from mani account id (out of band) before trusting it, so a compromised server can't slip in its own key.
They clone it by name. A shared member sees the vault's real name in mani vault ls and clones it like any other vault:
```
mani clone my-project
```

See who a vault is shared with (by email) at any time with mani vault members my-project.

Removing someone rotates the Vault Key, exactly like a device revocation, so they can't read anything saved after they're removed:

mani vault unshare my-project teammate@example.com

The remaining members are automatically re-sealed to the new key; the removed member keeps only whatever they had already pulled.

Revocation

mani device revoke <device>

Revoking a device immediately:

Deletes that device's wrapped copy of the AMK — it can no longer unwrap anything new.
Rotates the Vault Key for every vault the device had access to. New writes use the new VK; remaining devices keep reading old history through an epoch-aware key ring, not a single overwritten secret.

A revoked device retains whatever it already downloaded locally — revocation prevents future access, it doesn't reach into a device and delete data already on disk.

Listing devices

mani device ls

Shows every enrolled device, its platform, and enrollment time — useful before revoking the right one.