Meridian handbook
ReferenceCLI

CLI

Every engine-dmo and engine-cms command by purpose, the global flags, --json output (data or envelope), --quiet, how a command finds its project, and how to list the whole command tree as JSON.

Both binaries take the same commands, flags and arguments, except the commands of the DMO modules, which only engine-dmo has. This reference uses engine-dmo; for a core command, engine-cms behaves the same.

engine-dmo <command> [subcommand] [arguments] [flags]
engine-dmo <command> --help        # one command's flags
engine-dmo help --json             # every command, argument and flag, as JSON

Some --help and help --json texts cite documents by internal names, such as (07-auth-and-permissions.md), (ADR-0019) or make check. Those documents are not published and those make targets are not yours; this reference and the rest of the handbook describe the same behaviour.

Global flags

Every command takes these:

FlagDefaultMeaning
--project.The project directory. Commands that need a project read config/ under it
--configconfigThe configuration directory, relative to the project
--jsonoffMachine-readable output on standard output (below)
--quietoffPrint only errors. A command that prints data (a list, a report, a document) still prints it
--no-colouroffNo colour. A non-empty NO_COLOR environment variable does the same; colour is only ever used on a terminal

Output and exit codes

Under --json every command prints exactly one JSON document on standard output, in one of two shapes:

ShapeCommandsWhat it is
DataCommands whose job is to return something: content get, describe type, migrate status, version, template api and the other lists, reports and documentsThe command’s own document
EnvelopeCommands that act and report what they did: migrate up, schema apply, content publish, user create and the rest{"command": "...", "exit": 0, "error": "...", "lines": ["..."]}: the text output as lines, the exit code, and the error when there was one

Each command’s section below says which shape it prints. Errors, warnings and prompts go to standard error. The exit code is always meaningful:

CodeMeaning
0Success
1Error
2Changes pending, or refused for want of confirmation
3Configuration invalid, or a flag value that cannot be used (an unknown command or flag exits 1)
4Degraded but running

Exit codes says which commands use 2 and 4, and when.

Commands by purpose

Projects and development

CommandPurpose
initStart a project: the bare starter, or a copy of a project with --from
checkThe CI gate: configuration, schema, routes, templates. Exit 3 on invalid configuration
devdev up (serve with the config watcher) and the authoring verbs that change configuration safely
newScaffold a type, a template, a component or a block
describeThe project, a type, the field types, a route or a template, with ids
guideWorking guidance for this project, for a person or an agent
renderRender one public page in process, with errors, queries and findings
templateThe generated template API and template tests
buildRun the project’s frontend build, then check
assetsThe frontend build as the engine resolves it
lspThe template language server for an editor
docsThis handbook in the terminal, and served with the project’s template API
configThe resolved configuration, its validation, and the JSON Schema of every file
seedSeed sets: validated content with history, assets and analytics
pluginBuild the project’s plugins
completionShell completion scripts

Deploying and operating

CommandPurpose
serveStart the server
migrateEngine migrations, as a deploy step
schemaPlan and apply configuration against the database
healthLiveness and readiness against a running server
warmAfter a deploy: repair search, queue derivatives, warm the page cache
doctorThe support bundle
jobsThe job queue
scheduleScheduled tasks
telemetryTest the error reporter and the OTLP endpoint
versionVersion, bundle, modules, variant and capabilities
siteExport a site as a standalone install, or retire it
sarA subject access request bundle for one email address
dpiaA data protection impact assessment filled from the configuration
auditVerify the audit log’s hash chain

Content and data

CommandPurpose
contentDocuments: list, get, create, update, publish, trash, restore, export, import
mediaThe media library: import, stats, transforms, warm, prune
searchThe search index and the query log
redirectsThe redirect rules table
localeLocales: coverage, drift, adding a locale’s drafts
translateTranslation jobs, the glossary and the memory
tagsThe tag vocabulary
exportStatic exports of the content API and embed widgets
apiThe content API’s contract, keys and answers
analyticsRollups, retention, exports and reports
webhooksOutbound webhook deliveries
aiThe AI provider, budget, review queue and activity log
a11yAccessibility audit, statement, issues and conformance report

People, mail and access

CommandPurpose
userStaff users and groups
accessThe effective permission matrix
mailTransactional mail: status, test, templates, suppression
newsletterNewsletter subscribers, campaigns and deliverability
listsSmart lists
mcpThe content MCP for a local agent, and a client for a remote one

DMO bundle only

CommandPurpose
crmOrganisations, memberships, duplicates, invitations, claims, imports, erasure
portalThe member portal’s templates
broadcastCRM broadcasts
affiliatesAffiliate networks and conversions

Some subcommands of shared commands are also engine-dmo only, such as analytics report, api member and the dev verbs for tiers, roles, slots and the portal; each is marked on its page.

Commands and the environment

Commands differ in how much of the project they read, and so in which environment variables must be set. A ${VAR} with no default is an error (environment variable VAR is not set, exit 3) in any command that loads the configuration with its secrets, even one that never connects to the database.

ReadsCommandsNeeds
Nothing of a projectinit, docs, version, help, completion, config schema, describe fieldtypesNothing
The configuration, with secrets left outcheck --no-db, describe project, describe type, template api, guide, and the dev verbs without --scaffold or --applyEvery ${VAR} without a default set, except those in a secret path such as database.url and server.security.signing_key
The whole configuration, without connectingconfig validate, config render, dpia, new, seed verify, seed write, describe template, and dev route add --scaffoldEvery ${VAR} without a default set, and each secret valid: server.security.signing_key, when the file names it, must be empty or at least 32 characters
The databasecheck without --no-db, render, describe route, serve, migrate, schema, seed apply, template test, a11y audit, lists, and every command that reads or writes content, users or jobsA reachable database in database.url, plus the above

To work without a database, set placeholders in your shell. The commands in the first three rows never connect with them:

export DATABASE_URL=postgres://localhost/placeholder
export SIGNING_KEY=""     # only when engine.yaml names ${SIGNING_KEY}; empty means a development key

An empty SIGNING_KEY is accepted outside production, where the engine derives a development key; a value of 1 to 31 characters is refused (signing_key must be at least 32 characters). An empty DATABASE_URL is refused (database.url is required), so it needs a placeholder address. The engine does not read .env files. --help on any command needs neither variable.