package.json

{
  "name": "keep",
  "version": "0.1.0",
  "license": "MIT",
  "type": "module",
  "bin": {
    "keep": "./dist/cli/index.js"
  },
  "scripts": {
    "dev:server": "tsx watch --env-file=.env src/server/index.ts",
    "cli": "tsx src/cli/index.ts",
    "build": "tsc",
    "start": "node --env-file=.env dist/server/index.js"
  },
  "dependencies": {
    "express": "^4.19.2",
    "better-sqlite3": "^11.3.0",
    "libsodium-wrappers": "^0.7.15"
  },
  "devDependencies": {
    "@types/express": "^4.17.21",
    "@types/node": "^22.0.0",
    "@types/better-sqlite3": "^7.6.11",
    "@types/libsodium-wrappers": "^0.7.14",
    "tsx": "^4.15.0",
    "typescript": "^5.5.0"
  }
}
Implement keep: self-hosted E2E encrypted secrets sync Server: Express + better-sqlite3 (WAL), multi-recipient key-wrapping per IMPLEMENTATION.md's design — vaults/recipients/vault_grants/ access_log. Two auth paths: ADMIN_PASSWORD header for recipient management and revoke (pure metadata operations), signed-request auth (Ed25519 signature over method+path+timestamp+body-hash) for push/pull/grant, mirroring the spirit of this project family's other signed-handshake patterns without naming them. CLI: identity init/show/set-id, push/pull/grant/log, admin recipient add/list/remove and revoke. Grant is a client-side crypto operation (the granter unwraps the vault's current key locally and reseals it for the new recipient) rather than a server-side operation, since the server never holds an unwrapped key to grant with. Verified end-to-end with two independent local identities against a live server and separately against the built Docker image: register, push, pull (granted and ungranted), grant without re-pushing, admin revoke, a subsequent rotation confirming the revoked recipient stays excluded, and rejection of missing/malformed signed-request auth. Two real bugs caught during verification, not just written up: - libsodium-wrappers' published ESM build does a relative import only resolvable under bundler-style resolution — broken under plain Node ESM. Fixed via createRequire to force the CJS build. - Express's req.path inside a sub-router is relative to the mount point, which would have silently mismatched a client signing the full request path. Fixed by verifying against req.originalUrl. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> 2026-07-12 19:38:24 +02:00			`{`
			`"name": "keep",`
			`"version": "0.1.0",`
			`"license": "MIT",`
			`"type": "module",`
			`"bin": {`
			`"keep": "./dist/cli/index.js"`
			`},`
			`"scripts": {`
			`"dev:server": "tsx watch --env-file=.env src/server/index.ts",`
			`"cli": "tsx src/cli/index.ts",`
			`"build": "tsc",`
			`"start": "node --env-file=.env dist/server/index.js"`
			`},`
			`"dependencies": {`
			`"express": "^4.19.2",`
			`"better-sqlite3": "^11.3.0",`
			`"libsodium-wrappers": "^0.7.15"`
			`},`
			`"devDependencies": {`
			`"@types/express": "^4.17.21",`
			`"@types/node": "^22.0.0",`
			`"@types/better-sqlite3": "^7.6.11",`
			`"@types/libsodium-wrappers": "^0.7.14",`
			`"tsx": "^4.15.0",`
			`"typescript": "^5.5.0"`
			`}`
			`}`