Implement keep: self-hosted E2E encrypted secrets sync

Server: Express + better-sqlite3 (WAL), multi-recipient key-wrapping
per IMPLEMENTATION.md's design — vaults/recipients/vault_grants/
access_log. Two auth paths: ADMIN_PASSWORD header for recipient
management and revoke (pure metadata operations), signed-request
auth (Ed25519 signature over method+path+timestamp+body-hash) for
push/pull/grant, mirroring the spirit of this project family's other
signed-handshake patterns without naming them.

CLI: identity init/show/set-id, push/pull/grant/log, admin recipient
add/list/remove and revoke. Grant is a client-side crypto operation
(the granter unwraps the vault's current key locally and reseals it
for the new recipient) rather than a server-side operation, since the
server never holds an unwrapped key to grant with.

Verified end-to-end with two independent local identities against a
live server and separately against the built Docker image: register,
push, pull (granted and ungranted), grant without re-pushing, admin
revoke, a subsequent rotation confirming the revoked recipient stays
excluded, and rejection of missing/malformed signed-request auth.

Two real bugs caught during verification, not just written up:
- libsodium-wrappers' published ESM build does a relative import only
  resolvable under bundler-style resolution — broken under plain Node
  ESM. Fixed via createRequire to force the CJS build.
- Express's req.path inside a sub-router is relative to the mount
  point, which would have silently mismatched a client signing the
  full request path. Fixed by verifying against req.originalUrl.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/cli/commands/vault.ts

@@ -0,0 +1,110 @@
+import fs from 'node:fs';
+import { requireIdentityAndRecipientId } from '../identityStore.js';
+import { signedFetch, adminFetch, expectOk } from '../signedFetch.js';
+import { parseEnv, serializeEnv } from '../envFormat.js';
+import {
+  ready,
+  Identity,
+  generateSymmetricKey,
+  secretboxEncrypt,
+  secretboxDecrypt,
+  enc,
+} from '../../shared/crypto.js';
+
+export async function vaultPush(vaultKey: string, file: string): Promise<void> {
+  await ready();
+  const { identity, recipientId } = await requireIdentityAndRecipientId();
+
+  if (!fs.existsSync(file)) throw new Error(`file not found: ${file}`);
+  const values = parseEnv(fs.readFileSync(file, 'utf8'));
+  const payload = enc.fromUtf8(JSON.stringify(values));
+
+  const existsRes = await expectOk(await signedFetch(identity, recipientId, 'GET', `/api/vaults/${encodeURIComponent(vaultKey)}/exists`));
+
+  const wrapFor = new Map<string, string>(); // recipientId -> publicKey
+  wrapFor.set(recipientId, identity.id);
+
+  if (existsRes.exists) {
+    const recipientsRes = await signedFetch(identity, recipientId, 'GET', `/api/vaults/${encodeURIComponent(vaultKey)}/recipients`);
+    if (!recipientsRes.ok) {
+      const body = await recipientsRes.json().catch(() => ({}));
+      throw new Error(body.error ?? `no access to vault '${vaultKey}' — ask an existing grantee to run 'keep grant ${vaultKey} ${recipientId}'`);
+    }
+    const current = await recipientsRes.json() as { recipientId: string; publicKey: string }[];
+    for (const r of current) if (r.publicKey) wrapFor.set(r.recipientId, r.publicKey);
+  }
+
+  const symmetricKey = generateSymmetricKey();
+  const { nonce, ciphertext } = secretboxEncrypt(symmetricKey, payload);
+
+  const wrappedKeys: Record<string, string> = {};
+  for (const [rid, pubHex] of wrapFor) {
+    wrappedKeys[rid] = enc.toBase64(Identity.sealFor(pubHex, symmetricKey));
+  }
+
+  await expectOk(await signedFetch(identity, recipientId, 'POST', `/api/vaults/${encodeURIComponent(vaultKey)}/push`, {
+    ciphertext: enc.toBase64(ciphertext),
+    nonce: enc.toBase64(nonce),
+    wrappedKeys,
+  }));
+
+  console.log(`pushed '${vaultKey}' — ${Object.keys(values).length} key${Object.keys(values).length === 1 ? '' : 's'}, wrapped for ${wrapFor.size} recipient${wrapFor.size === 1 ? '' : 's'}.`);
+}
+
+export async function vaultPull(vaultKey: string, format: 'env' | 'json', outFile?: string): Promise<void> {
+  await ready();
+  const { identity, recipientId } = await requireIdentityAndRecipientId();
+
+  const data = await expectOk(await signedFetch(identity, recipientId, 'GET', `/api/vaults/${encodeURIComponent(vaultKey)}/pull`));
+
+  const symmetricKey = identity.openSealed(enc.fromBase64(data.wrappedKey));
+  if (!symmetricKey) throw new Error('failed to unwrap this vault\'s key — wrong identity, or the grant is stale');
+
+  const plaintext = secretboxDecrypt(symmetricKey, enc.fromBase64(data.nonce), enc.fromBase64(data.ciphertext));
+  const values = JSON.parse(enc.toUtf8(plaintext)) as Record<string, string>;
+
+  const out = format === 'json' ? JSON.stringify(values, null, 2) : serializeEnv(values);
+  if (outFile) {
+    fs.writeFileSync(outFile, out);
+    console.error(`wrote ${Object.keys(values).length} key(s) to ${outFile}`);
+  } else {
+    process.stdout.write(out);
+  }
+}
+
+export async function vaultGrant(vaultKey: string, targetRecipientId: string): Promise<void> {
+  await ready();
+  const { identity, recipientId } = await requireIdentityAndRecipientId();
+
+  const pullRes = await expectOk(await signedFetch(identity, recipientId, 'GET', `/api/vaults/${encodeURIComponent(vaultKey)}/pull`));
+  const symmetricKey = identity.openSealed(enc.fromBase64(pullRes.wrappedKey));
+  if (!symmetricKey) throw new Error("failed to unwrap this vault's key — can't grant access to someone else without it");
+
+  const recipientsRes = await expectOk(await signedFetch(identity, recipientId, 'GET', '/api/recipients'));
+  const target = (recipientsRes as { recipientId: string; publicKey: string }[]).find(r => r.recipientId === targetRecipientId);
+  if (!target) throw new Error(`unknown recipient id: ${targetRecipientId} (ask an admin to 'keep recipient add' them first)`);
+
+  const wrappedKey = enc.toBase64(Identity.sealFor(target.publicKey, symmetricKey));
+  await expectOk(await signedFetch(identity, recipientId, 'POST', `/api/vaults/${encodeURIComponent(vaultKey)}/grant`, {
+    recipientId: targetRecipientId,
+    wrappedKey,
+  }));
+
+  console.log(`granted '${vaultKey}' to ${targetRecipientId}.`);
+}
+
+export async function vaultRevoke(vaultKey: string, targetRecipientId: string): Promise<void> {
+  await expectOk(await adminFetch('DELETE', `/api/admin/vaults/${encodeURIComponent(vaultKey)}/grants/${encodeURIComponent(targetRecipientId)}`));
+  console.log(`revoked ${targetRecipientId}'s access to '${vaultKey}'.`);
+  console.log(`Note: this stops future pulls only. If this was a compromise response, also run 'keep push ${vaultKey}' with rotated values.`);
+}
+
+export async function vaultLog(vaultKey: string): Promise<void> {
+  await ready();
+  const { identity, recipientId } = await requireIdentityAndRecipientId();
+  const entries = await expectOk(await signedFetch(identity, recipientId, 'GET', `/api/vaults/${encodeURIComponent(vaultKey)}/log`));
+  if (!entries.length) { console.log('no access log entries yet.'); return; }
+  for (const e of entries as { recipient_id: string; action: string; accessed_at: number }[]) {
+    console.log(`${new Date(e.accessed_at * 1000).toISOString()}  ${e.action.padEnd(6)}  ${e.recipient_id}`);
+  }
+}